From 31acbce474c0b83abfeb622572da105a273a1aca Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Wed, 24 Mar 2021 14:31:38 +0900
Subject: [PATCH] [NS04.7] Reinstate a necessary change

NS04.5 removed a security that it shouldn't have. Reinstate it.

Bug: 167544279
Test: ConnectivityServiceTest
Change-Id: If614da813a96d1b50a16fa4be5659e1647d9469d
---
 .../com/android/server/ConnectivityService.java   | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index 4c6e06f70277c..67cd6c388f4d3 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -6467,6 +6467,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
     }
 
+    private boolean isNetworkProviderWithIdRegistered(final int providerId) {
+        for (final NetworkProviderInfo npi : mNetworkProviderInfos.values()) {
+            if (npi.providerId == providerId) return true;
+        }
+        return false;
+    }
+
     /**
      * Register or update a network offer.
      * @param newOffer The new offer. If the callback member is the same as an existing
@@ -6474,7 +6481,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
      */
     private void handleRegisterNetworkOffer(@NonNull final NetworkOffer newOffer) {
         ensureRunningOnConnectivityServiceThread();
-
+        if (!isNetworkProviderWithIdRegistered(newOffer.providerId)) {
+            // This may actually happen if a provider updates its score or registers and then
+            // immediately unregisters. The offer would still be in the handler queue, but the
+            // provider would have been removed.
+            if (DBG) log("Received offer from an unregistered provider");
+            return;
+        }
         final NetworkOfferInfo existingOffer = findNetworkOfferInfoByCallback(newOffer.callback);
         if (null != existingOffer) {
             handleUnregisterNetworkOffer(existingOffer);