Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a358cfd authored by Grant Menke's avatar Grant Menke
Browse files

Ensure connection is unbound on call redirection timeout. 

This CL ensures that the connection is unbound when the call redirection timeout is hit in CallRedirectionProcessor. This resolves a reported security vulnerability.

Test: manual using the provided APK + updated CallRedirectionProcessorTest
Flag: EXEMPT Security High/Critical Severity CVE
Bug: 376461726
Change-Id: I76a65c3993f5107652f98bbe0283043ecff27a7c
parent facd6452

src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java

+8 −0
Original line number Diff line number Diff line
@@ -133,6 +133,14 @@ public class CallRedirectionProcessor implements CallRedirectionCallback { 
                            + mServiceType + " call redirection service");

                }

            }

            Log.i(this, "notifyTimeout: call redirection has timed out so "

                    + "unbinding the connection");

            if (mConnection != null) {

                // We still need to call unbind even if the service disconnected.

                mContext.unbindService(mConnection);

                mConnection = null;

            }

            mService = null;

        }



        private class CallRedirectionServiceConnection implements ServiceConnection {

tests/src/com/android/server/telecom/tests/CallRedirectionProcessorTest.java

+12 −0
Original line number Diff line number Diff line
@@ -221,6 +221,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(false), eq(CallRedirectionProcessor.UI_TYPE_NO_ACTION));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test
@@ -249,6 +252,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test
@@ -280,6 +286,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));



        // Wait for another carrier timeout time, but should not expect any carrier service request

        // is triggered.
@@ -289,6 +298,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test