commit bddb7706c974178431ad0a37a880f75c860ff9af
author Svetoslav <svetoslavganov@google.com> Tue Aug 04 18:53:12 2015 -0700
committer The Android Automerger <android-build@google.com> Wed Aug 05 12:18:09 2015 -0700
tree 22c8e5e5939ff9799699762cce2d159c62ddf0cd
parent 18e3b6c0a5bf32847b1f95f731171085ea7a5530

Media provider clears binder id calling in other providers

The media provider can call into the downloads provider which
runs in the same process from an IPC. In this case the
permission and ap ops checks in the downloads provider will
be verified against the caller of the media provider instead
of against the media provider itself.

bug:22629557

Change-Id: I444a2db96353f50c60cd1d7bb20538ab7d463a1e

src/com/android/providers/media/MediaProvider.java

diff --git a/src/com/android/providers/media/MediaProvider.java b/src/com/android/providers/media/MediaProvider.java
index 6c16076..0bbba76 100755
--- a/src/com/android/providers/media/MediaProvider.java
+++ b/src/com/android/providers/media/MediaProvider.java
@@ -3784,7 +3784,6 @@
         }
     }
 
-
     private MediaThumbRequest requestMediaThumbnail(String path, Uri uri, int priority, long magic) {
         synchronized (mMediaThumbQueue) {
             MediaThumbRequest req = null;
@@ -4992,6 +4991,8 @@
     private void writeAlbumArt(
             boolean need_to_recompress, Uri out, byte[] compressed, Bitmap bm) throws IOException {
         OutputStream outstream = null;
+        // Clear calling identity as we may be handling an IPC.
+        final long identity = Binder.clearCallingIdentity();
         try {
             outstream = getContext().getContentResolver().openOutputStream(out);
 
@@ -5005,6 +5006,7 @@
                 }
             }
         } finally {
+            Binder.restoreCallingIdentity(identity);
             IoUtils.closeQuietly(outstream);
         }
     }
@@ -5110,7 +5112,15 @@
                     // Note that this only does something if getAlbumArtOutputUri() reused an
                     // existing entry from the database. If a new entry was created, it will
                     // have been rolled back as part of backing out the transaction.
-                    getContext().getContentResolver().delete(out, null, null);
+
+                    // Clear calling identity as we may be handling an IPC.
+                    final long identity = Binder.clearCallingIdentity();
+                    try {
+                        getContext().getContentResolver().delete(out, null, null);
+                    } finally {
+                        Binder.restoreCallingIdentity(identity);
+                    }
+
                 }
             }
         }

src/com/android/providers/media/MediaThumbRequest.java

diff --git a/src/com/android/providers/media/MediaThumbRequest.java b/src/com/android/providers/media/MediaThumbRequest.java
index 34d54c8..3d7cc83 100644
--- a/src/com/android/providers/media/MediaThumbRequest.java
+++ b/src/com/android/providers/media/MediaThumbRequest.java
@@ -147,6 +147,8 @@
             if (fileMagic == magic) {
                 Cursor c = null;
                 ParcelFileDescriptor pfd = null;
+                // Clear calling identity as we may be handling an IPC.
+                final long identity = Binder.clearCallingIdentity();
                 try {
                     c = mCr.query(mThumbUri, THUMB_PROJECTION,
                             mOrigColumnName + " = " + mOrigId, null, null);
@@ -157,6 +159,7 @@
                 } catch (IOException ex) {
                     // MINI_THUMBNAIL not exists, ignore the exception and generate one.
                 } finally {
+                    Binder.restoreCallingIdentity(identity);
                     if (c != null) c.close();
                     if (pfd != null) {
                         pfd.close();