commit 36bcc77337814d4d36e2b10eb062ac417d91611e
author lumark <lumark@google.com> Mon Feb 10 18:41:57 2020 +0800
committer Bryan Ferris <bferris@google.com> Tue Mar 31 23:38:36 2020 +0000
tree daf48c3b8bf43fc6dcf319f33f6de1b435914ed4
parent ab012da3a2ee2f85dd940a662859915bbd93a7d7

[RESTRICT AUTOMERGE] Restrict app transition maximum duration

As WindowState#startAnimation for restricting window animation duration
(currently is 10 secs),

For security reason, we also need to restrict app transition animation
duration as 3 secs to prevent malicious app may set a long duration or
infinity repeat counts through ActivityOption#makeCustomAnimation or
Activity#overridePendingTransition with custom animation set.

Bug: 145728687
Test: manual as issue provided test app
Change-Id: I39051d6e4d2b681ce2becbafe14aab3f3d8ebf6b

services/core/java/com/android/server/wm/AppTransition.java

diff --git a/services/core/java/com/android/server/wm/AppTransition.java b/services/core/java/com/android/server/wm/AppTransition.java
index b1ed358..1d87b74 100644
--- a/services/core/java/com/android/server/wm/AppTransition.java
+++ b/services/core/java/com/android/server/wm/AppTransition.java
@@ -176,6 +176,7 @@
     private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420;
     private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336;
     private static final long APP_TRANSITION_TIMEOUT_MS = 5000;
+    static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs.
 
     private final Context mContext;
     private final WindowManagerService mService;

services/core/java/com/android/server/wm/WindowManagerService.java

diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index 8439669..bf48813 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -68,6 +68,7 @@
 import static android.view.WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER;
 import static com.android.server.LockGuard.INDEX_WINDOW;
 import static com.android.server.LockGuard.installLock;
+import static com.android.server.wm.AppTransition.MAX_APP_TRANSITION_DURATION;
 import static com.android.server.wm.AppTransition.TRANSIT_UNSET;
 import static com.android.server.wm.AppWindowAnimator.PROLONG_ANIMATION_AT_END;
 import static com.android.server.wm.AppWindowAnimator.PROLONG_ANIMATION_AT_START;
@@ -2361,7 +2362,16 @@
                     displayConfig.orientation, frame, displayFrame, insets, surfaceInsets,
                     isVoiceInteraction, freeform, atoken.getTask().mTaskId);
             if (a != null) {
-                if (DEBUG_ANIM) logWithStack(TAG, "Loaded animation " + a + " for " + atoken);
+                if (a != null) {
+                    // Setup the maximum app transition duration to prevent malicious app may set a long
+                    // animation duration or infinite repeat counts for the app transition through
+                    // ActivityOption#makeCustomAnimation or WindowManager#overridePendingTransition.
+                    a.restrictDuration(MAX_APP_TRANSITION_DURATION);
+                }
+                if (DEBUG_ANIM) {
+                    logWithStack(TAG, "Loaded animation " + a + " for " + atoken
+                            + ", duration: " + ((a != null) ? a.getDuration() : 0));
+                }
                 final int containingWidth = frame.width();
                 final int containingHeight = frame.height();
                 atoken.mAppAnimator.setAnimation(a, containingWidth, containingHeight, width,