From 5b05f77a12f794e2fb05c8058616dd9c4888c8bf Mon Sep 17 00:00:00 2001
From: Eugene Susla <eugenesusla@google.com>
Date: Wed, 10 Jan 2018 13:21:29 -0800
Subject: [PATCH] Prevent race condition when iterating over bound services

Fixes: 71770764
Test: cts
Change-Id: Ifb7457a6b9a88b466bf39a647b92531de6c3c70e
---
 .../server/accessibility/AccessibilityManagerService.java  | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index 50b0be1a11d21..bd5ee6a233c6d 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -1362,14 +1362,13 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
     private int computeRelevantEventTypes(UserState userState, Client client) {
         int relevantEventTypes = 0;
 
-        int numBoundServices = userState.mBoundServices.size();
-        for (int i = 0; i < numBoundServices; i++) {
-            AccessibilityServiceConnection service =
-                    userState.mBoundServices.get(i);
+        // Use iterator for thread-safety
+        for (AccessibilityServiceConnection service : userState.mBoundServices) {
             relevantEventTypes |= isClientInPackageWhitelist(service.getServiceInfo(), client)
                     ? service.getRelevantEventTypes()
                     : 0;
         }
+
         relevantEventTypes |= isClientInPackageWhitelist(
                 mUiAutomationManager.getServiceInfo(), client)
                 ? mUiAutomationManager.getRelevantEventTypes()