From 863d396f4ccabee91d51b04f72f44c34ffe351f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iv=C3=A1n=20Budnik?= Date: Tue, 6 Sep 2022 16:52:44 +0000 Subject: [PATCH] Enforce MediaButtonReceiver ComponentName belongs to app Adds check that enforces ComponentName's package belongs to calling app. This avoids privileged execution of arbitrary code through media button events. This is a partial revert revert of ag/19338169. Bug: 238177121 Test: atest CtsMediaBetterTogetherTestCases Change-Id: I4aba866a9758366175ea4af0d434729ad98fa48d (cherry picked from commit 1b2fa2486cc97fd9515300f858d4da2af8d8908c) Merged-In: I4aba866a9758366175ea4af0d434729ad98fa48d --- .../com/android/server/media/MediaSessionRecord.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/services/core/java/com/android/server/media/MediaSessionRecord.java b/services/core/java/com/android/server/media/MediaSessionRecord.java index 4822d6a62ac70..ab2f0f3d05452 100644 --- a/services/core/java/com/android/server/media/MediaSessionRecord.java +++ b/services/core/java/com/android/server/media/MediaSessionRecord.java @@ -53,6 +53,7 @@ import android.os.RemoteException; import android.os.ResultReceiver; import android.os.SystemClock; import android.text.TextUtils; +import android.util.EventLog; import android.util.Log; import android.view.KeyEvent; @@ -952,6 +953,14 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR public void setMediaButtonBroadcastReceiver(ComponentName receiver) throws RemoteException { final long token = Binder.clearCallingIdentity(); try { + //mPackageName has been verified in MediaSessionService.enforcePackageName(). + if (receiver != null && !TextUtils.equals( + mPackageName, receiver.getPackageName())) { + EventLog.writeEvent(0x534e4554, "238177121", -1, ""); // SafetyNet logging. + throw new IllegalArgumentException("receiver does not belong to " + + "package name provided to MediaSessionRecord. Pkg = " + mPackageName + + ", Receiver Pkg = " + receiver.getPackageName()); + } if ((mPolicies & MediaSessionPolicyProvider.SESSION_POLICY_IGNORE_BUTTON_RECEIVER) != 0) { return;