From be63495101dba3b0c3c496cdd810df9e30e926d4 Mon Sep 17 00:00:00 2001
From: Craig Mautner <cmautner@google.com>
Date: Thu, 12 Jun 2014 13:39:24 -0700
Subject: [PATCH] Fix permission problem and NPE

Remove uid before calling into Window Manager. Restore afterwards.

Check for null stack value before dereferencing.

Fixes bug 15591112.

Change-Id: Ida3de556940440162c91b8c1614d0f21e364abd8
---
 .../android/server/am/ActivityStackSupervisor.java   | 12 +++++++++++-
 .../core/java/com/android/server/wm/WindowState.java |  6 +++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActivityStackSupervisor.java b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
index 6cb57de8bc4a7..bca215dde51af 100644
--- a/services/core/java/com/android/server/am/ActivityStackSupervisor.java
+++ b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
@@ -2768,16 +2768,19 @@ public final class ActivityStackSupervisor implements DisplayListener {
 
     @Override
     public void onDisplayAdded(int displayId) {
+        Slog.v(TAG, "Display added displayId=" + displayId);
         mHandler.sendMessage(mHandler.obtainMessage(HANDLE_DISPLAY_ADDED, displayId, 0));
     }
 
     @Override
     public void onDisplayRemoved(int displayId) {
+        Slog.v(TAG, "Display removed displayId=" + displayId);
         mHandler.sendMessage(mHandler.obtainMessage(HANDLE_DISPLAY_REMOVED, displayId, 0));
     }
 
     @Override
     public void onDisplayChanged(int displayId) {
+        Slog.v(TAG, "Display changed displayId=" + displayId);
         mHandler.sendMessage(mHandler.obtainMessage(HANDLE_DISPLAY_CHANGED, displayId, 0));
     }
 
@@ -3048,10 +3051,17 @@ public final class ActivityStackSupervisor implements DisplayListener {
                     return;
                 }
                 mContainerState = CONTAINER_STATE_FINISHING;
+
                 final Message msg =
                         mHandler.obtainMessage(CONTAINER_TASK_LIST_EMPTY_TIMEOUT, this);
                 mHandler.sendMessageDelayed(msg, 1000);
-                mStack.finishAllActivitiesLocked();
+
+                long origId = Binder.clearCallingIdentity();
+                try {
+                    mStack.finishAllActivitiesLocked();
+                } finally {
+                    Binder.restoreCallingIdentity(origId);
+                }
             }
         }
 
diff --git a/services/core/java/com/android/server/wm/WindowState.java b/services/core/java/com/android/server/wm/WindowState.java
index 9f3415e63586b..0b11a1bfe686f 100644
--- a/services/core/java/com/android/server/wm/WindowState.java
+++ b/services/core/java/com/android/server/wm/WindowState.java
@@ -715,7 +715,11 @@ final class WindowState implements WindowManagerPolicy.WindowState {
     }
 
     public DisplayContent getDisplayContent() {
-        return mAppToken == null ? mDisplayContent : getStack().getDisplayContent();
+        if (mAppToken == null) {
+            return mDisplayContent;
+        }
+        final TaskStack stack = getStack();
+        return stack == null ? mDisplayContent : stack.getDisplayContent();
     }
 
     public int getDisplayId() {