From 6690dc54546809c973f7f630e6488fcd81dfaa82 Mon Sep 17 00:00:00 2001
From: Dave Sparks <davidsparks@android.com>
Date: Wed, 20 May 2009 19:20:31 -0700
Subject: [PATCH] Fix permission hole for RECORD_AUDIO created when we moved
 the MediaRecorder implementation to the mediaserver process. The permission
 check was previously enforced only at the AudioRecord binder interface for
 clients not in the same process. This change adds an additional check when
 the client tries to set the audio source. Bug 1868334

---
 media/libmediaplayerservice/MediaRecorderClient.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/media/libmediaplayerservice/MediaRecorderClient.cpp b/media/libmediaplayerservice/MediaRecorderClient.cpp
index e0d29474dc2f8..8bc410cbbe913 100644
--- a/media/libmediaplayerservice/MediaRecorderClient.cpp
+++ b/media/libmediaplayerservice/MediaRecorderClient.cpp
@@ -37,6 +37,7 @@
 namespace android {
 
 const char* cameraPermission = "android.permission.CAMERA";
+const char* recordAudioPermission = "android.permission.RECORD_AUDIO";
 
 static bool checkPermission(const char* permissionString) {
 #ifndef HAVE_ANDROID_OS
@@ -86,6 +87,9 @@ status_t MediaRecorderClient::setVideoSource(int vs)
 status_t MediaRecorderClient::setAudioSource(int as)
 {
     LOGV("setAudioSource(%d)", as);
+    if (!checkPermission(recordAudioPermission)) {
+        return PERMISSION_DENIED;
+    }
     Mutex::Autolock lock(mLock);
     if (mRecorder == NULL)  {
         LOGE("recorder is not initialized");