commit 1b9dc28da9496007bff3a93fc62a2069dd152779
author Jernej Virag <jernej@google.com> Fri Aug 12 18:06:23 2022 +0200
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Aug 19 18:43:34 2022 +0000
tree 0f98d56abbb04645e03f1b22ea66609846f82313
parent 8c1f443b554e1b78801ecffdbbe0e5274c9510d7

Prevent loading of Icon resources from the wrong package

If an Icon carries package designator, LocalImageResolver has now
ignored it. This could lead to loading of a wrong icon in cases where
the ID collided with the same ID in android package.

This is fixes that corner-case.

Bug: 241066484
Test: atest LocalImageResolverTest - the new test checks for pkg
      correctness and fails on devices without this cl

      manual test: bluejay device with known, reproducible resource
      collision in media player notification. In reproducible case,
      icon appears as a broken block.

      After applying this patch, small icon in media notification loads
      correctly for the collision case.

Change-Id: Ic79c0d4acb1d347a24282972e009a5a079ce6c21
(cherry picked from commit 32f176e4705694c9d0272eba22887cf6d4f7b783)
Merged-In: Ic79c0d4acb1d347a24282972e009a5a079ce6c21

core/java/com/android/internal/widget/LocalImageResolver.java

diff --git a/core/java/com/android/internal/widget/LocalImageResolver.java b/core/java/com/android/internal/widget/LocalImageResolver.java
index b866723..b11ea29 100644
--- a/core/java/com/android/internal/widget/LocalImageResolver.java
+++ b/core/java/com/android/internal/widget/LocalImageResolver.java
@@ -25,6 +25,7 @@
 import android.graphics.drawable.Drawable;
 import android.graphics.drawable.Icon;
 import android.net.Uri;
+import android.text.TextUtils;
 import android.util.Log;
 import android.util.Size;
 
@@ -108,6 +109,12 @@
                 }
                 break;
             case Icon.TYPE_RESOURCE:
+                if (!(TextUtils.isEmpty(icon.getResPackage())
+                        || context.getPackageName().equals(icon.getResPackage()))) {
+                    // We can't properly resolve icons from other packages here, so fall back.
+                    return icon.loadDrawable(context);
+                }
+
                 Drawable result = resolveImage(icon.getResId(), context, maxWidth, maxHeight);
                 if (result != null) {
                     return tintDrawable(icon, result);

core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java

diff --git a/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java b/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
index c63d18b..0cee526 100644
--- a/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
+++ b/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
@@ -270,4 +270,13 @@
         assertThat(bd.getBitmap().getHeight()).isEqualTo(originalHeight);
 
     }
+
+    @Test
+    public void resolveImage_iconWithOtherPackageResource_usesPackageContextDefinition()
+            throws IOException {
+        Icon icon = Icon.createWithResource("this_is_invalid", R.drawable.test32x24);
+        Drawable d = LocalImageResolver.resolveImage(icon, mContext);
+        // This drawable must not be loaded - if it was, the code ignored the package specification.
+        assertThat(d).isNull();
+    }
 }