From f0ec2e005083808bf68f9f0049b801276c290ae2 Mon Sep 17 00:00:00 2001
From: Jeff Sharkey <jsharkey@android.com>
Date: Mon, 21 Mar 2016 12:37:54 -0600
Subject: [PATCH] Mark even more Bundles as defusable.

Bug: 27766193
Change-Id: Ib027ac7b40c7a575a76f289faabde9655338865e
---
 media/java/android/media/MediaMetadata.java                 | 2 +-
 .../core/java/com/android/server/am/ActiveServices.java     | 6 ++----
 .../java/com/android/server/am/ActivityManagerService.java  | 1 +
 .../java/com/android/server/am/PendingIntentRecord.java     | 5 ++++-
 telecomm/java/android/telecom/ParcelableConnection.java     | 2 +-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/media/java/android/media/MediaMetadata.java b/media/java/android/media/MediaMetadata.java
index 722605f5d5448..9ebf10f527288 100644
--- a/media/java/android/media/MediaMetadata.java
+++ b/media/java/android/media/MediaMetadata.java
@@ -365,7 +365,7 @@ public final class MediaMetadata implements Parcelable {
     }
 
     private MediaMetadata(Parcel in) {
-        mBundle = in.readBundle();
+        mBundle = Bundle.setDefusable(in.readBundle(), true);
     }
 
     /**
diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 63a0e87efc59e..f51fb6c68cd4b 100755
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -811,10 +811,8 @@ public final class ActiveServices {
             // Hacky kind of thing -- allow system stuff to tell us
             // what they are, so we can report this elsewhere for
             // others to know why certain services are running.
-            try {
-                clientIntent = service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
-            } catch (RuntimeException e) {
-            }
+            service.setDefusable(true);
+            clientIntent = service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
             if (clientIntent != null) {
                 clientLabel = service.getIntExtra(Intent.EXTRA_CLIENT_LABEL, 0);
                 if (clientLabel != 0) {
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 5aac43d910f74..a22e0efb70d42 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -6923,6 +6923,7 @@ public final class ActivityManagerService extends ActivityManagerNative
                 intents[i].setDefusable(true);
             }
         }
+        Bundle.setDefusable(bOptions, true);
 
         final boolean noCreate = (flags&PendingIntent.FLAG_NO_CREATE) != 0;
         final boolean cancelCurrent = (flags&PendingIntent.FLAG_CANCEL_CURRENT) != 0;
diff --git a/services/core/java/com/android/server/am/PendingIntentRecord.java b/services/core/java/com/android/server/am/PendingIntentRecord.java
index 8039072dccda9..b8f45bc342a8f 100644
--- a/services/core/java/com/android/server/am/PendingIntentRecord.java
+++ b/services/core/java/com/android/server/am/PendingIntentRecord.java
@@ -208,7 +208,10 @@ final class PendingIntentRecord extends IIntentSender.Stub {
             String requiredPermission, IBinder resultTo, String resultWho, int requestCode,
             int flagsMask, int flagsValues, Bundle options, IActivityContainer container)
             throws TransactionTooLargeException {
-        synchronized(owner) {
+        if (intent != null) intent.setDefusable(true);
+        if (options != null) options.setDefusable(true);
+
+        synchronized (owner) {
             final ActivityContainer activityContainer = (ActivityContainer)container;
             if (activityContainer != null && activityContainer.mParentActivity != null &&
                     activityContainer.mParentActivity.state
diff --git a/telecomm/java/android/telecom/ParcelableConnection.java b/telecomm/java/android/telecom/ParcelableConnection.java
index fe0a4d8eef3d8..ce51c967e021c 100644
--- a/telecomm/java/android/telecom/ParcelableConnection.java
+++ b/telecomm/java/android/telecom/ParcelableConnection.java
@@ -188,7 +188,7 @@ public final class ParcelableConnection implements Parcelable {
             DisconnectCause disconnectCause = source.readParcelable(classLoader);
             List<String> conferenceableConnectionIds = new ArrayList<>();
             source.readStringList(conferenceableConnectionIds);
-            Bundle extras = source.readBundle(classLoader);
+            Bundle extras = Bundle.setDefusable(source.readBundle(classLoader), true);
 
             return new ParcelableConnection(
                     phoneAccount,