[RESTRICT AUTOMERGE] Ignore small source rect hint

Which may be abused by malicious app to create a non-visible PiP
window that bypasses the background restriction.

Bug: 270368476
Test: Manually, using the POC app
Change-Id: I3531a64fc67a1b6c43997ee33b7a7d4ab4e2d985

libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipBoundsAlgorithm.java

@@ -182,6 +182,21 @@ public class PipBoundsAlgorithm {
         return null;
     }
 
+    /**
+     * Returns the source hint rect if it is valid (if provided and is contained by the current
+     * task bounds and not too small).
+     */
+    public static Rect getValidSourceHintRect(PictureInPictureParams params, Rect sourceBounds,
+                @NonNull Rect destinationBounds) {
+        final Rect sourceHintRect = getValidSourceHintRect(params, sourceBounds);
+        if (sourceHintRect != null
+                && sourceHintRect.width() > destinationBounds.width()
+                && sourceHintRect.height() > destinationBounds.height()) {
+            return sourceHintRect;
+        }
+        return null;
+    }
+
     public float getDefaultAspectRatio() {
         return mDefaultAspectRatio;
     }

libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java

@@ -553,7 +553,7 @@ public class PipTaskOrganizer implements ShellTaskOrganizer.TaskListener,
         if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {
             mPipMenuController.attach(mLeash);
             final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
-                    info.pictureInPictureParams, currentBounds);
+                    info.pictureInPictureParams, currentBounds, destinationBounds);
             scheduleAnimateResizePip(currentBounds, destinationBounds, 0 /* startingAngle */,
                     sourceHintRect, TRANSITION_DIRECTION_TO_PIP, mEnterAnimationDuration,
                     null /* updateBoundsCallback */);
@@ -579,9 +579,9 @@ public class PipTaskOrganizer implements ShellTaskOrganizer.TaskListener,
             return;
         }
         final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds();
-        final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
-                mPictureInPictureParams, currentBounds);
         final Rect destinationBounds = mPipBoundsAlgorithm.getEntryDestinationBounds();
+        final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
+                mPictureInPictureParams, currentBounds, destinationBounds);
         animateResizePip(currentBounds, destinationBounds, sourceHintRect,
                 TRANSITION_DIRECTION_TO_PIP, mEnterAnimationDuration, 0 /* startingAngle */);
         mPipTransitionState.setTransitionState(PipTransitionState.ENTERING_PIP);

libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTransition.java

@@ -318,7 +318,7 @@ public class PipTransition extends PipTransitionController {
         if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {
             final Rect sourceHintRect =
                     PipBoundsAlgorithm.getValidSourceHintRect(
-                            taskInfo.pictureInPictureParams, currentBounds);
+                            taskInfo.pictureInPictureParams, currentBounds, destinationBounds);
             animator = mPipAnimationController.getAnimator(taskInfo, leash, currentBounds,
                     currentBounds, destinationBounds, sourceHintRect, TRANSITION_DIRECTION_TO_PIP,
                     0 /* startingAngle */, rotationDelta);