From b3c3958020567525583c01b8c88cafdb6471d269 Mon Sep 17 00:00:00 2001 From: Makoto Onuki Date: Fri, 30 Mar 2018 16:46:19 -0700 Subject: [PATCH] Fix erroneous protected-broadcast check This happens because isPermittedShellBroadcast() is called twice, one for runtime receivers and the other manifest receivers, and when SysUI sends a broadcast to its own runtime receiver, another check also happens for manifest receivers but there's no receivers. Fixes: 77154348 Test: Manual test with the following steps: - adb shell dumpsys battery unplug - adb shell settings delete secure low_power_manual_activation_count - adb shell settings delete secure low_power_warning_acknowledged - adb shell settings delete secure suppress_auto_battery_saver - Then enable battery saver - Make sure there's no error on logcat. Change-Id: I9e4305016e10059bd067f06d05433102864b2036 --- .../java/com/android/server/am/ActivityManagerService.java | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 08e5d44c8832..26549b2a702e 100644 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -20936,8 +20936,16 @@ public class ActivityManagerService extends IActivityManager.Stub // explicitly list each action as a protected broadcast, so we will check for that // one safe case and allow it: an explicit broadcast, only being received by something // that has protected itself. - if (receivers != null && receivers.size() > 0 - && (intent.getPackage() != null || intent.getComponent() != null)) { + if (intent.getPackage() != null || intent.getComponent() != null) { + if (receivers == null || receivers.size() == 0) { + // Intent is explicit and there's no receivers. + // This happens, e.g. , when a system component sends a broadcast to + // its own runtime receiver, and there's no manifest receivers for it, + // because this method is called twice for each broadcast, + // for runtime receivers and manifest receivers and the later check would find + // no receivers. + return; + } boolean allProtected = true; for (int i = receivers.size()-1; i >= 0; i--) { Object target = receivers.get(i); -- 2.11.0