From 4e9af38ec483eb16ebf64f049c540e2bd1909b6f Mon Sep 17 00:00:00 2001 From: Jaewan Kim Date: Wed, 21 Sep 2016 10:07:24 +0900 Subject: [PATCH] DO NOT MERGE Check caller for sending media key to global priority session Prevent sending media key events from the non-system app to the global priority session through the MediaSessionManager.dispatchMediaKeyEvent(). Note that any app can use the API indirectly with the public API AudioManager.dispatchMediaKeyEvent(). Bug: 29833954 Tested: Installed malicious apps and confirmed that they don't work. Tested: Run CtsTelecomTestCases and CtsMediaTestCases Change-Id: I2a9e78196ba7455324e485f098f095d03b47ee15 --- .../com/android/server/media/MediaSessionService.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/services/core/java/com/android/server/media/MediaSessionService.java b/services/core/java/com/android/server/media/MediaSessionService.java index 02c9fcb517ac3..ea4c3313861fc 100644 --- a/services/core/java/com/android/server/media/MediaSessionService.java +++ b/services/core/java/com/android/server/media/MediaSessionService.java @@ -47,6 +47,7 @@ import android.os.Handler; import android.os.IBinder; import android.os.Message; import android.os.PowerManager; +import android.os.Process; import android.os.RemoteException; import android.os.ResultReceiver; import android.os.ServiceManager; @@ -697,6 +698,14 @@ public class MediaSessionService extends SystemService implements Monitor { final int uid = Binder.getCallingUid(); final long token = Binder.clearCallingIdentity(); + if (isGlobalPriorityActive() && uid != Process.SYSTEM_UID) { + // Prevent dispatching key event through reflection while the global priority + // session is active. + Slog.i(TAG, "Only the system can dispatch media key event " + + "to the global priority session."); + return; + } + try { synchronized (mLock) { MediaSessionRecord session = mPriorityStack