Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee57ec06 authored by Daniel Norman's avatar Daniel Norman Committed by Automerger Merge Worker
Browse files

Checks if AccessibilityServiceInfo is within parcelable size. am: 553232c2 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/21238189



Change-Id: I6f43e318730e584b79e3f0cb9caabbe705b618af
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 4e04a41a 553232c2

core/java/android/accessibilityservice/AccessibilityService.java

+4 −0
Original line number Diff line number Diff line
@@ -1982,6 +1982,10 @@ public abstract class AccessibilityService extends Service { 
        IAccessibilityServiceConnection connection =

            AccessibilityInteractionClient.getInstance().getConnection(mConnectionId);

        if (mInfo != null && connection != null) {

            if (!mInfo.isWithinParcelableSize()) {

                throw new IllegalStateException(

                        "Cannot update service info: size is larger than safe parcelable limits.");

            }

            try {

                connection.setServiceInfo(mInfo);

                mInfo = null;

core/java/android/accessibilityservice/AccessibilityServiceInfo.java

+10 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ import android.content.res.XmlResourceParser; 
import android.graphics.drawable.Drawable;

import android.hardware.fingerprint.FingerprintManager;

import android.os.Build;

import android.os.IBinder;

import android.os.Parcel;

import android.os.Parcelable;

import android.os.RemoteException;
@@ -1028,6 +1029,15 @@ public class AccessibilityServiceInfo implements Parcelable { 
        return 0;

    }



    /** @hide */

    public final boolean isWithinParcelableSize() {

        final Parcel parcel = Parcel.obtain();

        writeToParcel(parcel, 0);

        final boolean result = parcel.dataSize() <= IBinder.MAX_IPC_SIZE;

        parcel.recycle();

        return result;

    }



    public void writeToParcel(Parcel parcel, int flagz) {

        parcel.writeInt(eventTypes);

        parcel.writeStringArray(packageNames);

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+6 −0
Original line number Diff line number Diff line
@@ -1353,6 +1353,12 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub 
            AccessibilityServiceInfo accessibilityServiceInfo;

            try {

                accessibilityServiceInfo = new AccessibilityServiceInfo(resolveInfo, mContext);

                if (!accessibilityServiceInfo.isWithinParcelableSize()) {

                    Slog.e(LOG_TAG, "Skipping service "

                            + accessibilityServiceInfo.getResolveInfo().getComponentInfo()

                            + " because service info size is larger than safe parcelable limits.");

                    continue;

                }

                if (userState.mCrashedServices.contains(serviceInfo.getComponentName())) {

                    // Restore the crashed attribute.

                    accessibilityServiceInfo.crashed = true;