Merge "Bypass app package visibility for package name check"

media/java/android/media/IMediaRouterService.aidl

@@ -50,6 +50,7 @@ interface IMediaRouterService {
     // MediaRouterService.java for readability.
 
     // Methods for MediaRouter2
+    boolean verifyPackageName(String clientPackageName);
     void enforceMediaContentControlPermission();
     List<MediaRoute2Info> getSystemRoutes();
     RoutingSessionInfo getSystemSessionInfo();

media/java/android/media/MediaRouter2.java

@@ -26,7 +26,6 @@ import android.annotation.RequiresPermission;
 import android.annotation.SystemApi;
 import android.annotation.TestApi;
 import android.content.Context;
-import android.content.pm.PackageManager;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.Looper;
@@ -211,18 +210,14 @@ public final class MediaRouter2 {
         try {
             // SecurityException will be thrown if there's no permission.
             serviceBinder.enforceMediaContentControlPermission();
+            if (!serviceBinder.verifyPackageName(clientPackageName)) {
+                Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");
+                return null;
+            }
         } catch (RemoteException e) {
             e.rethrowFromSystemServer();
         }
 
-        PackageManager pm = context.getPackageManager();
-        try {
-            pm.getPackageInfo(clientPackageName, 0);
-        } catch (PackageManager.NameNotFoundException ex) {
-            Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");
-            return null;
-        }
-
         synchronized (sSystemRouterLock) {
             MediaRouter2 instance = sSystemMediaRouter2Map.get(clientPackageName);
             if (instance == null) {

services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java

@@ -152,6 +152,21 @@ class MediaRouter2ServiceImpl {
 
     // Start of methods that implement MediaRouter2 operations.
 
+    @NonNull
+    public boolean verifyPackageName(@NonNull String clientPackageName) {
+        final long token = Binder.clearCallingIdentity();
+
+        try {
+            PackageManager pm = mContext.getPackageManager();
+            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));
+            return true;
+        } catch (PackageManager.NameNotFoundException ex) {
+            return false;
+        } finally {
+            Binder.restoreCallingIdentity(token);
+        }
+    }
+
     @NonNull
     public void enforceMediaContentControlPermission() {
         final int pid = Binder.getCallingPid();

services/core/java/com/android/server/media/MediaRouterService.java

@@ -378,6 +378,12 @@ public final class MediaRouterService extends IMediaRouterService.Stub
         mService2.dump(pw, "");
     }
 
+    // Binder call
+    @Override
+    public boolean verifyPackageName(String clientPackageName) {
+        return mService2.verifyPackageName(clientPackageName);
+    }
+
     // Binder call
     @Override
     public void enforceMediaContentControlPermission() {