commit f8f00e8d5d5c78c6ceb37bb6731163ea78aff367
author Riddle Hsu <riddlehsu@google.com> Wed Mar 04 17:48:30 2020 +0800
committer Riddle Hsu <riddlehsu@google.com> Tue Mar 10 03:43:22 2020 +0000
tree f4b5333dced3d69352137401a0f6c071141dbe36
parent 39527e80a15f5fa3da19956031286667187ac7b8

Add test for attaching null application thread

Test that the operation will be rejected. This ensures a process
record won't have unexpected state temporally which may disturb
the condition to check caller information.

Bug: 144285917
Test: atest CtsSecurityTestCases:ActivityManagerTest# \
      testActivityManager_attachNullApplication
Change-Id: Ib774109ff54c871cd37eb00a9db11a28a5109053

tests/tests/security/src/android/security/cts/ActivityManagerTest.java

diff --git a/tests/tests/security/src/android/security/cts/ActivityManagerTest.java b/tests/tests/security/src/android/security/cts/ActivityManagerTest.java
index 5a035dd..47730e1 100644
--- a/tests/tests/security/src/android/security/cts/ActivityManagerTest.java
+++ b/tests/tests/security/src/android/security/cts/ActivityManagerTest.java
@@ -15,11 +15,15 @@
  */
 package android.security.cts;
 
+import android.app.ActivityManager;
 import android.os.IBinder;
 import android.platform.test.annotations.SecurityTest;
+import android.util.Log;
 
 import junit.framework.TestCase;
 
+import java.lang.reflect.InvocationTargetException;
+
 @SecurityTest
 public class ActivityManagerTest extends TestCase {
 
@@ -44,4 +48,32 @@
             // Patched devices should throw this exception
         }
     }
+
+    // b/144285917
+    @SecurityTest(minPatchLevel = "2020-05")
+    public void testActivityManager_attachNullApplication() {
+        SecurityException securityException = null;
+        Exception unexpectedException = null;
+        try {
+            final Object iam = ActivityManager.class.getDeclaredMethod("getService").invoke(null);
+            Class.forName("android.app.IActivityManager").getDeclaredMethod("attachApplication",
+                    Class.forName("android.app.IApplicationThread"), long.class)
+                    .invoke(iam, null /* thread */, 0 /* startSeq */);
+        } catch (SecurityException e) {
+            securityException = e;
+        } catch (InvocationTargetException e) {
+            if (e.getCause() instanceof SecurityException) {
+                securityException = (SecurityException) e.getCause();
+            } else {
+                unexpectedException = e;
+            }
+        } catch (Exception e) {
+            unexpectedException = e;
+        }
+        if (unexpectedException != null) {
+            Log.w("ActivityManagerTest", "Unexpected exception", unexpectedException);
+        }
+
+        assertNotNull("Expect SecurityException by attaching null application", securityException);
+    }
 }