From 56bbeff99a628be8e1d805db2638a4b87fedb106 Mon Sep 17 00:00:00 2001
From: Alan Viverette <alanv@google.com>
Date: Wed, 17 Jun 2015 15:33:54 -0700
Subject: [PATCH] Clear/restore calling identity in
 AccessibilityInteractionClient

To quote sendAccessibilityEvent(), "it is possible that this manager is
in the same process as the service but client using it is called through
Binder from another process."

Bug: 21737301
Change-Id: I8d4699a0ca8187a12235741ce420948061798f27
---
 .../AccessibilityInteractionClient.java          | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/core/java/android/view/accessibility/AccessibilityInteractionClient.java b/core/java/android/view/accessibility/AccessibilityInteractionClient.java
index db78ec5776c24..b49cbc6245ba1 100644
--- a/core/java/android/view/accessibility/AccessibilityInteractionClient.java
+++ b/core/java/android/view/accessibility/AccessibilityInteractionClient.java
@@ -186,7 +186,9 @@ public final class AccessibilityInteractionClient
                 if (DEBUG) {
                     Log.i(LOG_TAG, "Window cache miss");
                 }
+                final long identityToken = Binder.clearCallingIdentity();
                 window = connection.getWindow(accessibilityWindowId);
+                Binder.restoreCallingIdentity(identityToken);
                 if (window != null) {
                     sAccessibilityCache.addWindow(window);
                     return window;
@@ -222,7 +224,9 @@ public final class AccessibilityInteractionClient
                 if (DEBUG) {
                     Log.i(LOG_TAG, "Windows cache miss");
                 }
+                final long identityToken = Binder.clearCallingIdentity();
                 windows = connection.getWindows();
+                Binder.restoreCallingIdentity(identityToken);
                 if (windows != null) {
                     final int windowCount = windows.size();
                     for (int i = 0; i < windowCount; i++) {
@@ -282,9 +286,11 @@ public final class AccessibilityInteractionClient
                     }
                 }
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfoByAccessibilityId(
                         accessibilityWindowId, accessibilityNodeId, interactionId, this,
                         prefetchFlags, Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 // If the scale is zero the call has failed.
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
@@ -328,9 +334,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfosByViewId(
                         accessibilityWindowId, accessibilityNodeId, viewId, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
                             interactionId);
@@ -374,9 +382,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfosByText(
                         accessibilityWindowId, accessibilityNodeId, text, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
                             interactionId);
@@ -419,9 +429,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findFocus(accessibilityWindowId,
                         accessibilityNodeId, focusType, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     AccessibilityNodeInfo info = getFindAccessibilityNodeInfoResultAndClear(
                             interactionId);
@@ -461,9 +473,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.focusSearch(accessibilityWindowId,
                         accessibilityNodeId, direction, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     AccessibilityNodeInfo info = getFindAccessibilityNodeInfoResultAndClear(
                             interactionId);
@@ -502,9 +516,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.performAccessibilityAction(
                         accessibilityWindowId, accessibilityNodeId, action, arguments,
                         interactionId, this, Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     return getPerformAccessibilityActionResultAndClear(interactionId);
                 }