From 2f24cbe924145017de24744f006aef1745b04c81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iv=C3=A1n=20Budnik?= <ivanbuper@google.com>
Date: Thu, 1 Dec 2022 18:31:44 +0000
Subject: [PATCH] Bypass app package visibility for package name check

With this change, MediaRouter2 will validate package name against the
full list of installed packages, rather than the app's restricted
package list. This will avoid MediaRouter2 failing to validate existing
package names.

Test: atest CtsMediaBetterTogetherTestCases MediaRouter2HostSideTest
Bug: 260870618
Bug: 238178508
Change-Id: I38031e98228b3783889a5eeefd7478ec22663516
---
 media/java/android/media/IMediaRouterService.aidl |  1 +
 media/java/android/media/MediaRouter2.java        | 13 ++++---------
 .../server/media/MediaRouter2ServiceImpl.java     | 15 +++++++++++++++
 .../android/server/media/MediaRouterService.java  |  6 ++++++
 4 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/media/java/android/media/IMediaRouterService.aidl b/media/java/android/media/IMediaRouterService.aidl
index bddda4ab5002c..f6a9162cda39b 100644
--- a/media/java/android/media/IMediaRouterService.aidl
+++ b/media/java/android/media/IMediaRouterService.aidl
@@ -50,6 +50,7 @@ interface IMediaRouterService {
     // MediaRouterService.java for readability.
 
     // Methods for MediaRouter2
+    boolean verifyPackageName(String clientPackageName);
     void enforceMediaContentControlPermission();
     List<MediaRoute2Info> getSystemRoutes();
     RoutingSessionInfo getSystemSessionInfo();
diff --git a/media/java/android/media/MediaRouter2.java b/media/java/android/media/MediaRouter2.java
index d57a56a09fdb2..5faa794151b1a 100644
--- a/media/java/android/media/MediaRouter2.java
+++ b/media/java/android/media/MediaRouter2.java
@@ -26,7 +26,6 @@ import android.annotation.RequiresPermission;
 import android.annotation.SystemApi;
 import android.annotation.TestApi;
 import android.content.Context;
-import android.content.pm.PackageManager;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.Looper;
@@ -211,18 +210,14 @@ public final class MediaRouter2 {
         try {
             // SecurityException will be thrown if there's no permission.
             serviceBinder.enforceMediaContentControlPermission();
+            if (!serviceBinder.verifyPackageName(clientPackageName)) {
+                Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");
+                return null;
+            }
         } catch (RemoteException e) {
             e.rethrowFromSystemServer();
         }
 
-        PackageManager pm = context.getPackageManager();
-        try {
-            pm.getPackageInfo(clientPackageName, 0);
-        } catch (PackageManager.NameNotFoundException ex) {
-            Log.e(TAG, "Package " + clientPackageName + " not found. Ignoring.");
-            return null;
-        }
-
         synchronized (sSystemRouterLock) {
             MediaRouter2 instance = sSystemMediaRouter2Map.get(clientPackageName);
             if (instance == null) {
diff --git a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
index d6846bed2a144..55bc7b63a5553 100644
--- a/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
+++ b/services/core/java/com/android/server/media/MediaRouter2ServiceImpl.java
@@ -152,6 +152,21 @@ class MediaRouter2ServiceImpl {
 
     // Start of methods that implement MediaRouter2 operations.
 
+    @NonNull
+    public boolean verifyPackageName(@NonNull String clientPackageName) {
+        final long token = Binder.clearCallingIdentity();
+
+        try {
+            PackageManager pm = mContext.getPackageManager();
+            pm.getPackageInfo(clientPackageName, PackageManager.PackageInfoFlags.of(0));
+            return true;
+        } catch (PackageManager.NameNotFoundException ex) {
+            return false;
+        } finally {
+            Binder.restoreCallingIdentity(token);
+        }
+    }
+
     @NonNull
     public void enforceMediaContentControlPermission() {
         final int pid = Binder.getCallingPid();
diff --git a/services/core/java/com/android/server/media/MediaRouterService.java b/services/core/java/com/android/server/media/MediaRouterService.java
index beab5ea5bcb05..ad82e1c786e39 100644
--- a/services/core/java/com/android/server/media/MediaRouterService.java
+++ b/services/core/java/com/android/server/media/MediaRouterService.java
@@ -378,6 +378,12 @@ public final class MediaRouterService extends IMediaRouterService.Stub
         mService2.dump(pw, "");
     }
 
+    // Binder call
+    @Override
+    public boolean verifyPackageName(String clientPackageName) {
+        return mService2.verifyPackageName(clientPackageName);
+    }
+
     // Binder call
     @Override
     public void enforceMediaContentControlPermission() {