From d409d18686fb4e03714969e0e159f8afe5f16f8e Mon Sep 17 00:00:00 2001 From: Jaewan Kim Date: Mon, 19 Sep 2016 21:19:55 +0900 Subject: [PATCH] Check caller for sending media key to global priority session Prevent sending media key events from the non-system app to the global priority session through the MediaSessionManager.dispatchMediaKeyEvent(). Note that any app can use the API indirectly with the public API AudioManager.dispatchMediaKeyEvent(). Bug: 29833954 Tested: Installed malicious apps and confirmed that they don't work. Tested: Run CtsTelecomTestCases and CtsMediaTestCases Change-Id: I2a9e78196ba7455324e485f098f095d03b47ee15 --- .../core/java/com/android/server/media/MediaSessionService.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/services/core/java/com/android/server/media/MediaSessionService.java b/services/core/java/com/android/server/media/MediaSessionService.java index 697186e562fb..34f6aa7f73ab 100644 --- a/services/core/java/com/android/server/media/MediaSessionService.java +++ b/services/core/java/com/android/server/media/MediaSessionService.java @@ -767,6 +767,13 @@ public class MediaSessionService extends SystemService implements Monitor { + "setup is in progress."); return; } + if (isGlobalPriorityActive() && uid != Process.SYSTEM_UID) { + // Prevent dispatching key event through reflection while the global priority + // session is active. + Slog.i(TAG, "Only the system can dispatch media key event " + + "to the global priority session."); + return; + } synchronized (mLock) { // If we don't have a media button receiver to fall back on -- 2.11.0