From e68c1f3d6a2ad12cb47a5b2b1311a0bdc7b47d01 Mon Sep 17 00:00:00 2001
From: Andras Kloczl <andraskloczl@google.com>
Date: Tue, 16 Feb 2021 19:25:10 +0000
Subject: [PATCH] Prevent using invalid result uri during multi user image
 change

Test: manual
Bug: 172939189
Change-Id: Id2e598878b3250e8b3590905c6def561e2437d55
---
 .../settingslib/users/EditUserPhotoController.java       | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
index ecd40667843e0..f9584a3e15e9a 100644
--- a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
+++ b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
@@ -38,6 +38,7 @@ import android.os.UserHandle;
 import android.os.UserManager;
 import android.provider.ContactsContract.DisplayPhoto;
 import android.provider.MediaStore;
+import android.util.EventLog;
 import android.util.Log;
 import android.view.Gravity;
 import android.view.View;
@@ -126,6 +127,14 @@ public class EditUserPhotoController {
         }
         final Uri pictureUri = data != null && data.getData() != null
                 ? data.getData() : mTakePictureUri;
+
+        // Check if the result is a content uri
+        if (!ContentResolver.SCHEME_CONTENT.equals(pictureUri.getScheme())) {
+            Log.e(TAG, "Invalid pictureUri scheme: " + pictureUri.getScheme());
+            EventLog.writeEvent(0x534e4554, "172939189", -1, pictureUri.getPath());
+            return false;
+        }
+
         switch (requestCode) {
             case REQUEST_CODE_CROP_PHOTO:
                 onPhotoCropped(pictureUri);