commit fbef21b8b8bead802aa7c936ec72bfdd250243f3
author Karsten Tausche <karsten@fairphone.com> Wed Jan 20 10:15:13 2021 +0100
committer Karsten Tausche <karsten@fairphone.com> Wed Jan 20 10:15:14 2021 +0100
tree 0f7f8dd1e5c83de081482155ef0b3d11e9757377
parent 941cb233faa5473de35c411e2646e2426b891089
parent 0bf3b00898526f04fc1a07f676ce247cde360ba6

Merge the 2021-02-05 SPL branch from AOSP-Partner

* security-aosp-pi-release:
  Fix security vulnerability of TelecomManager#getPhoneAccountsForPackage

Change-Id: Idf8ddb66565368c27f2d72ea58de017c3f5f208d

src/com/android/server/telecom/TelecomServiceImpl.java

diff --git a/src/com/android/server/telecom/TelecomServiceImpl.java b/src/com/android/server/telecom/TelecomServiceImpl.java
index ded42db..0db1764 100644
--- a/src/com/android/server/telecom/TelecomServiceImpl.java
+++ b/src/com/android/server/telecom/TelecomServiceImpl.java
@@ -234,6 +234,23 @@
 
         @Override
         public List<PhoneAccountHandle> getPhoneAccountsForPackage(String packageName) {
+            //TODO: Deprecate this in S
+            try {
+                enforceCallingPackage(packageName);
+            } catch (SecurityException se1) {
+                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),
+                        "getPhoneAccountsForPackage: invalid calling package");
+                throw se1;
+            }
+
+            try {
+                enforcePermission(READ_PRIVILEGED_PHONE_STATE);
+            } catch (SecurityException se2) {
+                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),
+                        "getPhoneAccountsForPackage: no permission");
+                throw se2;
+            }
+
             synchronized (mLock) {
                 final UserHandle callingUserHandle = Binder.getCallingUserHandle();
                 long token = Binder.clearCallingIdentity();