commit 56c7360497823ed83d4eb04ef32c117e9c5608d6
author Sunny Goyal <sunnygoyal@google.com> Fri Sep 25 12:55:01 2015 -0700
committer Sunny Goyal <sunnygoyal@google.com> Thu Oct 08 14:49:55 2015 -0700
tree adfeda2a636960d856d9527e1299ce9d9a0e2812
parent cf12698fccddc832069eece02b352d689bf950b6

Verify that the widget id is valid, before binding the widget

Bug: 23820213
Bug: 24054205
Bug: 24582322
Change-Id: I25a09b0a2a706812a7d82729b5dc554ffba84a2a

src/com/android/launcher3/Launcher.java

diff --git a/src/com/android/launcher3/Launcher.java b/src/com/android/launcher3/Launcher.java
index c6cb779..9569ec6 100644
--- a/src/com/android/launcher3/Launcher.java
+++ b/src/com/android/launcher3/Launcher.java
@@ -2398,11 +2398,13 @@
             }
         } else if (itemInfo instanceof LauncherAppWidgetInfo) {
             final LauncherAppWidgetInfo widgetInfo = (LauncherAppWidgetInfo) itemInfo;
-            unbindAppWidget(widgetInfo, deleteFromDb);
             mWorkspace.removeWorkspaceItem(v);
+            removeWidgetToAutoAdvance(widgetInfo.hostView);
+            widgetInfo.hostView = null;
             if (deleteFromDb) {
-                LauncherModel.deleteItemFromDatabase(this, widgetInfo);
+                deleteWidgetInfo(widgetInfo);
             }
+
         } else {
             return false;
         }
@@ -2417,12 +2419,11 @@
     }
 
     /**
-     * Unbinds any launcher references to the widget and deletes the app widget id.
+     * Deletes the widget info and the widget id.
      */
-    private void unbindAppWidget(final LauncherAppWidgetInfo widgetInfo, boolean deleteAppWidgetId) {
+    private void deleteWidgetInfo(final LauncherAppWidgetInfo widgetInfo) {
         final LauncherAppWidgetHost appWidgetHost = getAppWidgetHost();
-        if (deleteAppWidgetId && appWidgetHost != null &&
-                !widgetInfo.isCustomWidget() && widgetInfo.isWidgetIdValid()) {
+        if (appWidgetHost != null && !widgetInfo.isCustomWidget() && widgetInfo.isWidgetIdValid()) {
             // Deleting an app widget ID is a void call but writes to disk before returning
             // to the caller...
             new AsyncTask<Void, Void, Void>() {
@@ -2432,8 +2433,7 @@
                 }
             }.executeOnExecutor(Utilities.THREAD_POOL_EXECUTOR);
         }
-        removeWidgetToAutoAdvance(widgetInfo.hostView);
-        widgetInfo.hostView = null;
+        LauncherModel.deleteItemFromDatabase(this, widgetInfo);
     }
 
     @Override
@@ -4001,6 +4001,15 @@
                         + appWidgetInfo.provider);
             }
 
+            // Verify that we own the widget
+            AppWidgetProviderInfo info = mAppWidgetManager.getAppWidgetInfo(appWidgetId);
+            if (info == null || appWidgetInfo == null ||
+                    !info.provider.equals(appWidgetInfo.provider)) {
+                Log.e(TAG, "Removing invalid widget: id=" + item.appWidgetId);
+                deleteWidgetInfo(item);
+                return;
+            }
+
             item.hostView = mAppWidgetHost.createView(this, appWidgetId, appWidgetInfo);
             item.minSpanX = appWidgetInfo.minSpanX;
             item.minSpanY = appWidgetInfo.minSpanY;