From 8d2382ca031bac4f1dc4fc0c86b93b4f829cbf42 Mon Sep 17 00:00:00 2001
From: Jackal Guo <jackalguo@google.com>
Date: Mon, 26 Sep 2022 16:16:42 +0800
Subject: [PATCH] Add existing and visibility check in addPackageDependency

We should check if the target package is existing or visible to the
caller before adding the dependency.

Bug: 216633741
Test: atest -p services/core/java/com/android/server/am
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: I8b3b6579bdfb040c8a10065ac14367ba7e4b15a9
---
 .../java/com/android/server/am/ActivityManagerService.java  | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 9d24e8e8638ee..8b1790968aba6 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -4158,6 +4158,12 @@ public class ActivityManagerService extends IActivityManager.Stub
             //  Yeah, um, no.
             return;
         }
+        final int callingUid = Binder.getCallingUid();
+        final int callingUserId = UserHandle.getUserId(callingUid);
+        if (getPackageManagerInternal().filterAppAccess(packageName, callingUid, callingUserId)) {
+            Slog.w(TAG, "Failed trying to add dependency on non-existing package: " + packageName);
+            return;
+        }
         ProcessRecord proc;
         synchronized (mPidsSelfLocked) {
             proc = mPidsSelfLocked.get(Binder.getCallingPid());