From 5c887619f286edd0427cca63ab6b17f1970714ca Mon Sep 17 00:00:00 2001
From: Andrea Ambu <andreaambu@google.com>
Date: Tue, 29 Jun 2021 18:36:36 +0100
Subject: [PATCH] speech: Check componentName maps to RecognitionService

Bug: 188908756
Fix: 188908756
Test: CtsVoiceRecognitionTestCases and manual on bug POC
Change-Id: Ic2395f62499367cf882340598dde6e79e4723a61
---
 .../SpeechRecognitionManagerServiceImpl.java  | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java b/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
index eee08c221bfac..264ef87c97bfc 100644
--- a/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
+++ b/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
@@ -24,6 +24,7 @@ import android.content.AttributionSource;
 import android.content.ComponentName;
 import android.content.Intent;
 import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
 import android.content.pm.ServiceInfo;
 import android.os.Binder;
 import android.os.IBinder;
@@ -31,6 +32,7 @@ import android.os.RemoteException;
 import android.speech.IRecognitionListener;
 import android.speech.IRecognitionService;
 import android.speech.IRecognitionServiceManagerCallback;
+import android.speech.RecognitionService;
 import android.speech.SpeechRecognizer;
 import android.util.Slog;
 
@@ -39,6 +41,7 @@ import com.android.server.infra.AbstractPerUserSystemService;
 
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
@@ -225,6 +228,10 @@ final class SpeechRecognitionManagerServiceImpl extends
                 }
             }
 
+            if (serviceComponent != null && !componentMapsToRecognitionService(serviceComponent)) {
+                return null;
+            }
+
             RemoteSpeechRecognitionService service =
                     new RemoteSpeechRecognitionService(
                             getContext(), serviceComponent, getUserId(), callingUid);
@@ -241,6 +248,25 @@ final class SpeechRecognitionManagerServiceImpl extends
         }
     }
 
+    private boolean componentMapsToRecognitionService(@NonNull ComponentName serviceComponent) {
+        List<ResolveInfo> resolveInfos =
+                getContext().getPackageManager().queryIntentServices(
+                        new Intent(RecognitionService.SERVICE_INTERFACE), 0);
+        if (resolveInfos == null) {
+            return false;
+        }
+
+        for (ResolveInfo ri : resolveInfos) {
+            if (ri.serviceInfo != null
+                    && serviceComponent.equals(ri.serviceInfo.getComponentName())) {
+                return true;
+            }
+        }
+
+        Slog.w(TAG, "serviceComponent is not RecognitionService: " + serviceComponent);
+        return false;
+    }
+
     private void removeService(int callingUid, RemoteSpeechRecognitionService service) {
         synchronized (mLock) {
             Set<RemoteSpeechRecognitionService> valuesByCaller =