Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 1ab2e129 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'android-security-14.0.0_r17' into staging/lineage-21.0_merge-android-security-14.0.0_r17 

Android Security 14.0.0 Release 17 (12787469)

# -----BEGIN PGP SIGNATURE-----
#
# iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCZ6D2/wAKCRDorT+BmrEO
# eLqpAJ0TS93S2Mg377oJIS7QuaMPpP6vvgCdGO4Hag5WYBQpDxn/YCl+ALRTQ70=
# =og50
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon Feb  3 19:03:59 2025 EET
# gpg:                using DSA key 4340D13570EF945E83810964E8AD3F819AB10E78
# gpg: Good signature from "The Android Open Source Project <initial-contribution@android.com>" [ultimate]

# By Grant Menke (2) and others
# Via Android Build Coastguard Worker
* tag 'android-security-14.0.0_r17':
  Unbind CS if connection is not created within 15 seconds.
  Revert "DO NOT MERGE"
  Resolve cross-user image exploit for conference status hints
  Unbind CallScreeningService when timeout reached.
  DO NOT MERGE Unbind CS if connection is not created within 15 seconds.

 Conflicts:
	src/com/android/server/telecom/ConnectionServiceWrapper.java
	tests/src/com/android/server/telecom/tests/CallsManagerTest.java

Change-Id: If9df0b361ba51e531bd191451426555a998d0c48
parents fcc9a883 66037caa

src/com/android/server/telecom/Call.java

+1 −0
Original line number Diff line number Diff line
@@ -1206,6 +1206,7 @@ public class Call implements CreateConnectionResponse, EventManager.Loggable, 
        return (!mIsTransactionalCall ? mConnectionService : mTransactionalService);

    }



    @VisibleForTesting

    public int getState() {

        return mState;

    }

src/com/android/server/telecom/ConnectionServiceWrapper.java

+55 −42
Original line number Diff line number Diff line
@@ -45,8 +45,8 @@ import android.telecom.ConnectionService; 
import android.telecom.DisconnectCause;

import android.telecom.GatewayInfo;

import android.telecom.Log;

import android.telecom.Logging.Runnable;

import android.telecom.Logging.Session;

import android.telecom.Logging.Runnable;

import android.telecom.ParcelableConference;

import android.telecom.ParcelableConnection;

import android.telecom.PhoneAccountHandle;
@@ -118,6 +118,7 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
    // Pre-allocate space for 2 calls; realistically thats all we should ever need (tm)

    private final Map<Call, ScheduledFuture<?>> mScheduledFutureMap = new ConcurrentHashMap<>(2);

    private AnomalyReporterAdapter mAnomalyReporter = new AnomalyReporterAdapterImpl();



    private final class Adapter extends IConnectionServiceAdapter.Stub {



        @Override
@@ -131,7 +132,7 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
                synchronized (mLock) {

                    logIncoming("handleCreateConnectionComplete %s", callId);

                    Call call = mCallIdMapper.getCall(callId);

                    if (mScheduledFutureMap.containsKey(call)) {

                    if (call != null && mScheduledFutureMap.containsKey(call)) {

                        ScheduledFuture<?> existingTimeout = mScheduledFutureMap.get(call);

                        existingTimeout.cancel(false /* cancelIfRunning */);

                        mScheduledFutureMap.remove(call);
@@ -174,18 +175,18 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
            try {

                synchronized (mLock) {

                    logIncoming("handleCreateConferenceComplete %s", callId);

                    Call call = mCallIdMapper.getCall(callId);

                    if (call != null && mScheduledFutureMap.containsKey(call)) {

                        ScheduledFuture<?> existingTimeout = mScheduledFutureMap.get(call);

                        existingTimeout.cancel(false /* cancelIfRunning */);

                        mScheduledFutureMap.remove(call);

                    }

                    // Check status hints image for cross user access

                    if (conference.getStatusHints() != null) {

                        Icon icon = conference.getStatusHints().getIcon();

                        conference.getStatusHints().setIcon(StatusHints.

                                validateAccountIconUserBoundary(icon, callingUserHandle));

                    }

                    Call call = mCallIdMapper.getCall(callId);

                    if (mScheduledFutureMap.containsKey(call)) {

                        ScheduledFuture<?> existingTimeout = mScheduledFutureMap.get(call);

                        existingTimeout.cancel(false /* cancelIfRunning */);

                        mScheduledFutureMap.remove(call);

                    }

                    ConnectionServiceWrapper.this

                            .handleCreateConferenceComplete(callId, request, conference);
@@ -2458,6 +2459,13 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
    @Override

    protected void removeServiceInterface() {

        Log.v(this, "Removing Connection Service Adapter.");

        if (mServiceInterface == null) {

            // In some cases, we may receive multiple calls to

            // remoteServiceInterface, such as when the remote process crashes

            // (onBinderDied & onServiceDisconnected)

            Log.w(this, "removeServiceInterface: mServiceInterface is null");

            return;

        }

        removeConnectionServiceAdapter(mAdapter);

        // We have lost our service connection. Notify the world that this service is done.

        // We must notify the adapter before CallsManager. The adapter will force any pending
@@ -2466,6 +2474,10 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
        handleConnectionServiceDeath();

        mCallsManager.handleConnectionServiceDeath(this);

        mServiceInterface = null;

        if (mScheduledExecutor != null) {

            mScheduledExecutor.shutdown();

            mScheduledExecutor = null;

        }

    }



    @Override
@@ -2585,6 +2597,7 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
            }

        }

        mCallIdMapper.clear();

        mScheduledFutureMap.clear();



        if (mConnSvrFocusListener != null) {

            mConnSvrFocusListener.onConnectionServiceDeath(this);