Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 642bf8c1 authored by Pranav Madapurmath's avatar Pranav Madapurmath Committed by Automerger Merge Worker
Browse files

Merge "Resolve cross-user image exploit for conference status hints" into... 

Merge "Resolve cross-user image exploit for conference status hints" into sc-dev am: 7a697439 am: 01055f01 am: 74068360

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/services/Telecomm/+/27801273



Change-Id: I8c03dc9120df4b46040ba991cf25f3afd50a0119
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 84c5028e 74068360

src/com/android/server/telecom/ConnectionServiceWrapper.java

+7 −0
Original line number Diff line number Diff line
@@ -139,10 +139,17 @@ public class ConnectionServiceWrapper extends ServiceBinder implements 
                ParcelableConference conference, Session.Info sessionInfo) {

            Log.startSession(sessionInfo, LogUtils.Sessions.CSW_HANDLE_CREATE_CONNECTION_COMPLETE,

                    mPackageAbbreviation);

            UserHandle callingUserHandle = Binder.getCallingUserHandle();

            long token = Binder.clearCallingIdentity();

            try {

                synchronized (mLock) {

                    logIncoming("handleCreateConferenceComplete %s", callId);

                    // Check status hints image for cross user access

                    if (conference.getStatusHints() != null) {

                        Icon icon = conference.getStatusHints().getIcon();

                        conference.getStatusHints().setIcon(StatusHints.

                                validateAccountIconUserBoundary(icon, callingUserHandle));

                    }

                    Call call = mCallIdMapper.getCall(callId);

                    if (mScheduledFutureMap.containsKey(call)) {

                        ScheduledFuture<?> existingTimeout = mScheduledFutureMap.get(call);