Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64fc589e authored by Grant Menke's avatar Grant Menke
Browse files

Ensure connection is unbound on call redirection timeout. 

This CL ensures that the connection is unbound when the call redirection timeout is hit in CallRedirectionProcessor. This resolves a reported security vulnerability.

Test: manual using the provided APK + updated CallRedirectionProcessorTest
Flag: EXEMPT Security High/Critical Severity CVE
Bug: 376461726
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4a358cfd8e403597651a6962e8e43c11ea906a59)
Merged-In: I76a65c3993f5107652f98bbe0283043ecff27a7c
Change-Id: I76a65c3993f5107652f98bbe0283043ecff27a7c
parent 3d877aa5

src/com/android/server/telecom/callredirection/CallRedirectionProcessor.java

+12 −0
Original line number Diff line number Diff line
@@ -124,6 +124,17 @@ public class CallRedirectionProcessor implements CallRedirectionCallback { 
            }

        }



        public void notifyTimeout() {

            Log.i(this, "notifyTimeout: call redirection has timed out so "

                    + "unbinding the connection");

            if (mConnection != null) {

                // We still need to call unbind even if the service disconnected.

                mContext.unbindService(mConnection);

                mConnection = null;

            }

            mService = null;

        }



        private class CallRedirectionServiceConnection implements ServiceConnection {

            @Override

            public void onServiceConnected(ComponentName componentName, IBinder service) {
@@ -421,6 +432,7 @@ public class CallRedirectionProcessor implements CallRedirectionCallback { 
                    Log.addEvent(mCall, serviceType.equals(SERVICE_TYPE_USER_DEFINED)

                            ? LogUtils.Events.REDIRECTION_TIMED_OUT_USER

                            : LogUtils.Events.REDIRECTION_TIMED_OUT_CARRIER);

                    mAttempt.notifyTimeout();

                    if (serviceType.equals(SERVICE_TYPE_USER_DEFINED)) {

                        mUiAction = UI_TYPE_USER_DEFINED_TIMEOUT;

                        mShouldCancelCall = true;

tests/src/com/android/server/telecom/tests/CallRedirectionProcessorTest.java

+12 −0
Original line number Diff line number Diff line
@@ -219,6 +219,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(false), eq(CallRedirectionProcessor.UI_TYPE_NO_ACTION));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test
@@ -247,6 +250,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test
@@ -278,6 +284,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));



        // Wait for another carrier timeout time, but should not expect any carrier service request

        // is triggered.
@@ -287,6 +296,9 @@ public class CallRedirectionProcessorTest extends TelecomTestCase { 
        verify(mCallsManager, times(1)).onCallRedirectionComplete(eq(mCall), any(),

                eq(mPhoneAccountHandle), eq(null), eq(SPEAKER_PHONE_ON), eq(VIDEO_STATE),

                eq(true), eq(CallRedirectionProcessor.UI_TYPE_USER_DEFINED_TIMEOUT));

        // Verify service was unbound

        verify(mContext, times(1)).

                unbindService(any(ServiceConnection.class));

    }



    @Test