From 72210c49405570dfb3b79220536ccb9e102b7f8c Mon Sep 17 00:00:00 2001
From: Santiago Etchebehere <santie@google.com>
Date: Fri, 3 Dec 2021 10:50:10 -0800
Subject: [PATCH] Disallow too large display padding for wallpaper

To avoid a potential vulnerability, don't allow padding
with width or height larger than the maximum screen width.

Bug: 204316511
Test: added WallpaperManagerTest
Change-Id: I471fb3546bdd2f9aa07dd091fe841b2bc5c484d6
Merged-In: I471fb3546bdd2f9aa07dd091fe841b2bc5c484d6
---
 .../server/wallpaper/WallpaperManagerService.java   | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
index eddb5e977fa2f..15a41f6b3d2c4 100644
--- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
+++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
@@ -2267,6 +2267,19 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
                 throw new IllegalArgumentException("padding must be positive: " + padding);
             }
 
+            int maxSize = getMaximumSizeDimension(displayId);
+
+            final int paddingWidth = padding.left + padding.right;
+            final int paddingHeight = padding.top + padding.bottom;
+            if (paddingWidth > maxSize) {
+                throw new IllegalArgumentException("padding width " + paddingWidth
+                        + " exceeds max width " + maxSize);
+            }
+            if (paddingHeight > maxSize) {
+                throw new IllegalArgumentException("padding height " + paddingHeight
+                        + " exceeds max height " + maxSize);
+            }
+
             final DisplayData wpdData = getDisplayDataOrCreate(displayId);
             if (!padding.equals(wpdData.mPadding)) {
                 wpdData.mPadding.set(padding);