From 3c8415330f4b862470426148b191115e61093a36 Mon Sep 17 00:00:00 2001
From: Huihong Luo <huisinro@google.com>
Date: Sat, 20 Nov 2021 12:05:03 -0800
Subject: [PATCH] Migrate IRegionSamplingListener interface to AIDL

This addresses security vulnerabilities due to hard coded binder
interface.

Bug: 195660647
Test: (1) atest RegionSamplingTest
      (2) install Google I/O 2019 app, tap Agenda menu, scrolling to
      examine the bottom horizontal bar color changes
Change-Id: I453e348461ff31b1e12a8080acb87e203dbe4ca0
---
 ...droid_view_CompositionSamplingListener.cpp | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/core/jni/android_view_CompositionSamplingListener.cpp b/core/jni/android_view_CompositionSamplingListener.cpp
index 783b0d45ba932..59c01dc375932 100644
--- a/core/jni/android_view_CompositionSamplingListener.cpp
+++ b/core/jni/android_view_CompositionSamplingListener.cpp
@@ -16,21 +16,19 @@
 
 #define LOG_TAG "CompositionSamplingListener"
 
-#include "android_util_Binder.h"
-#include "core_jni_helpers.h"
-
-#include <nativehelper/JNIHelp.h>
-
+#include <android/gui/BnRegionSamplingListener.h>
 #include <android_runtime/AndroidRuntime.h>
 #include <android_runtime/Log.h>
-#include <utils/Log.h>
-#include <utils/RefBase.h>
 #include <binder/IServiceManager.h>
-
-#include <gui/IRegionSamplingListener.h>
 #include <gui/ISurfaceComposer.h>
 #include <gui/SurfaceComposerClient.h>
+#include <nativehelper/JNIHelp.h>
 #include <ui/Rect.h>
+#include <utils/Log.h>
+#include <utils/RefBase.h>
+
+#include "android_util_Binder.h"
+#include "core_jni_helpers.h"
 
 namespace android {
 
@@ -41,18 +39,18 @@ struct {
     jmethodID mDispatchOnSampleCollected;
 } gListenerClassInfo;
 
-struct CompositionSamplingListener : public BnRegionSamplingListener {
+struct CompositionSamplingListener : public gui::BnRegionSamplingListener {
     CompositionSamplingListener(JNIEnv* env, jobject listener)
             : mListener(env->NewWeakGlobalRef(listener)) {}
 
-    void onSampleCollected(float medianLuma) override {
+    binder::Status onSampleCollected(float medianLuma) override {
         JNIEnv* env = AndroidRuntime::getJNIEnv();
         LOG_ALWAYS_FATAL_IF(env == nullptr, "Unable to retrieve JNIEnv in onSampleCollected.");
 
         jobject listener = env->NewGlobalRef(mListener);
         if (listener == NULL) {
             // Weak reference went out of scope
-            return;
+            return binder::Status::ok();
         }
         env->CallStaticVoidMethod(gListenerClassInfo.mClass,
                 gListenerClassInfo.mDispatchOnSampleCollected, listener,
@@ -64,6 +62,8 @@ struct CompositionSamplingListener : public BnRegionSamplingListener {
             LOGE_EX(env);
             env->ExceptionClear();
         }
+
+        return binder::Status::ok();
     }
 
 protected: