MidiService: limit number of devices

Also limit number of listeners and connections.

Bug: 210864154
Test: see bug for repro steps
Test: Check status with:  adb shell dumpsys midi
Test: Test: atest CtsMidiTestCases
Test: https://source.android.com/devices/audio/midi_test.html
Change-Id: If5ab4518873f52136f52d8ac654b78a72717838a

services/midi/java/com/android/server/midi/MidiService.java

@@ -90,6 +90,11 @@ public class MidiService extends IMidiManager.Stub {
 
     private static final String TAG = "MidiService";
 
+    // These limits are much higher than any normal app should need.
+    private static final int MAX_DEVICE_SERVERS_PER_UID = 16;
+    private static final int MAX_LISTENERS_PER_CLIENT = 16;
+    private static final int MAX_CONNECTIONS_PER_CLIENT = 64;
+
     private final Context mContext;
 
     // list of all our clients, keyed by Binder token
@@ -161,6 +166,10 @@ public class MidiService extends IMidiManager.Stub {
         }
 
         public void addListener(IMidiDeviceListener listener) {
+            if (mListeners.size() >= MAX_LISTENERS_PER_CLIENT) {
+                throw new SecurityException(
+                        "too many MIDI listeners for UID = " + mUid);
+            }
             // Use asBinder() so that we can match it in removeListener().
             // The listener proxy objects themselves do not match.
             mListeners.put(listener.asBinder(), listener);
@@ -174,6 +183,10 @@ public class MidiService extends IMidiManager.Stub {
         }
 
         public void addDeviceConnection(Device device, IMidiDeviceOpenCallback callback) {
+            if (mDeviceConnections.size() >= MAX_CONNECTIONS_PER_CLIENT) {
+                throw new SecurityException(
+                        "too many MIDI connections for UID = " + mUid);
+            }
             DeviceConnection connection = new DeviceConnection(device, this, callback);
             mDeviceConnections.put(connection.getToken(), connection);
             device.addDeviceConnection(connection);
@@ -902,6 +915,19 @@ public class MidiService extends IMidiManager.Stub {
             IMidiDeviceServer server, ServiceInfo serviceInfo,
             boolean isPrivate, int uid, int defaultProtocol) {
 
+        // Limit the number of devices per app.
+        int deviceCountForApp = 0;
+        for (Device device : mDevicesByInfo.values()) {
+            if (device.getUid() == uid) {
+                deviceCountForApp++;
+            }
+        }
+        if (deviceCountForApp >= MAX_DEVICE_SERVERS_PER_UID) {
+            throw new SecurityException(
+                    "too many MIDI devices already created for UID = "
+                    + uid);
+        }
+
         int id = mNextDeviceId++;
         MidiDeviceInfo deviceInfo = new MidiDeviceInfo(type, id, numInputPorts, numOutputPorts,
                 inputPortNames, outputPortNames, properties, isPrivate,