Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e90905ad authored by Jean-Michel Trivi's avatar Jean-Michel Trivi Committed by Brint E. Kriebel
Browse files

Do not persist and restore the media button event receiver 

Do not persist the media button event receiver.
Do not restore the media button event receiver on behalf of the
  application that registered. Prevents reported vulnerability.

Bug 15428797

Change-Id: I7ca3e7fccb165c55b23f471c00e0ed77436f7dc1
parent 8594be30

media/java/android/media/AudioService.java

+0 −3
Original line number Diff line number Diff line
@@ -815,9 +815,6 @@ public class AudioService extends IAudioService.Stub { 
        // Broadcast vibrate settings

        broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_RINGER);

        broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_NOTIFICATION);



        // Restore the default media button receiver from the system settings

        mMediaFocusControl.restoreMediaButtonReceiver();

    }



    private int rescaleIndex(int index, int srcStream, int dstStream) {

media/java/android/media/MediaFocusControl.java

+0 −56
Original line number Diff line number Diff line
@@ -318,7 +318,6 @@ public class MediaFocusControl implements OnFinished { 
    //==========================================================================================



    // event handler messages

    private static final int MSG_PERSIST_MEDIABUTTONRECEIVER = 0;

    private static final int MSG_RCDISPLAY_CLEAR = 1;

    private static final int MSG_RCDISPLAY_UPDATE = 2;

    private static final int MSG_REEVALUATE_REMOTE = 3;
@@ -359,9 +358,6 @@ public class MediaFocusControl implements OnFinished { 
        @Override

        public void handleMessage(Message msg) {

            switch(msg.what) {

                case MSG_PERSIST_MEDIABUTTONRECEIVER:

                    onHandlePersistMediaButtonReceiver( (ComponentName) msg.obj );

                    break;



                case MSG_RCDISPLAY_CLEAR:

                    onRcDisplayClear();
@@ -1433,50 +1429,10 @@ public class MediaFocusControl implements OnFinished { 
                        }

                    }

                }

                if (mRCStack.empty()) {

                    // no saved media button receiver

                    mEventHandler.sendMessage(

                            mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0,

                                    null));

                } else if (oldTop != mRCStack.peek()) {

                    // the top of the stack has changed, save it in the system settings

                    // by posting a message to persist it; only do this however if it has

                    // a concrete component name (is not a transient registration)

                    RemoteControlStackEntry rcse = mRCStack.peek();

                    if (rcse.mReceiverComponent != null) {

                        mEventHandler.sendMessage(

                                mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0,

                                        rcse.mReceiverComponent));

                    }

                }

            }

        }

    }



    /**

     * Helper function:

     * Restore remote control receiver from the system settings.

     */

    protected void restoreMediaButtonReceiver() {

        String receiverName = Settings.System.getStringForUser(mContentResolver,

                Settings.System.MEDIA_BUTTON_RECEIVER, UserHandle.USER_CURRENT);

        if ((null != receiverName) && !receiverName.isEmpty()) {

            ComponentName eventReceiver = ComponentName.unflattenFromString(receiverName);

            if (eventReceiver == null) {

                // an invalid name was persisted

                return;

            }

            // construct a PendingIntent targeted to the restored component name

            // for the media button and register it

            Intent mediaButtonIntent = new Intent(Intent.ACTION_MEDIA_BUTTON);

            //     the associated intent will be handled by the component being registered

            mediaButtonIntent.setComponent(eventReceiver);

            PendingIntent pi = PendingIntent.getBroadcast(mContext,

                    0/*requestCode, ignored*/, mediaButtonIntent, 0/*flags*/);

            registerMediaButtonIntent(pi, eventReceiver, null);

        }

    }



    /**

     * Helper function:

     * Set the new remote control receiver at the top of the RC focus stack.
@@ -1515,12 +1471,6 @@ public class MediaFocusControl implements OnFinished { 
        }

        mRCStack.push(rcse); // rcse is never null



        // post message to persist the default media button receiver

        if (target != null) {

            mEventHandler.sendMessage( mEventHandler.obtainMessage(

                    MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, target/*obj*/) );

        }



        // RC stack was modified

        return true;

    }
@@ -1559,12 +1509,6 @@ public class MediaFocusControl implements OnFinished { 
        return false;

    }



    private void onHandlePersistMediaButtonReceiver(ComponentName receiver) {

        Settings.System.putStringForUser(mContentResolver,

                                         Settings.System.MEDIA_BUTTON_RECEIVER,

                                         receiver == null ? "" : receiver.flattenToString(),

                                         UserHandle.USER_CURRENT);

    }



    //==========================================================================================

    // Remote control display / client