Snap for 13264465 from 8e805fbc118233a7f21a516e6b7a81be4ee59503 to 25Q2-release Change-Id: I49c95e6e12273e1544c16949935e571cdc32c0dd

diff --git a/core/chre_message_hub_manager.cc b/core/chre_message_hub_manager.cc
index 8d5726d..7b3c46e 100644
--- a/core/chre_message_hub_manager.cc
+++ b/core/chre_message_hub_manager.cc

@@ -288,17 +288,26 @@
                                         chreMessageFreeFunction *freeCallback,
                                         EndpointId fromEndpointId) {
   bool success = false;
-  pw::UniquePtr<std::byte[]> messageData =
-      mAllocator.MakeUniqueArrayWithCallback(
-          reinterpret_cast<std::byte *>(message), messageSize,
-          MessageFreeCallbackData{.freeCallback = freeCallback,
-                                  .nanoappId = fromEndpointId});
-  if (messageData == nullptr) {
-    LOG_OOM();
+  if ((message == nullptr) != (freeCallback == nullptr)) {
+    // We don't allow this because a null callback with non-null message is
+    // susceptible to bugs where the nanoapp modifies the data while it is still
+    // being used by the system, and a non-null callback with null message is
+    // not meaningful since there is no data to release and we make no
+    // guarantees about when the callback is invoked.
+    LOGE("Mixing null and non-null message and free callback is not allowed");
   } else {
-    success = mChreMessageHub.sendMessage(std::move(messageData), messageType,
-                                          messagePermissions, sessionId,
-                                          fromEndpointId);
+    pw::UniquePtr<std::byte[]> messageData =
+        mAllocator.MakeUniqueArrayWithCallback(
+            reinterpret_cast<std::byte *>(message), messageSize,
+            MessageFreeCallbackData{.freeCallback = freeCallback,
+                                    .nanoappId = fromEndpointId});
+    if (messageData == nullptr) {
+      LOG_OOM();
+    } else {
+      success = mChreMessageHub.sendMessage(std::move(messageData), messageType,
+                                            messagePermissions, sessionId,
+                                            fromEndpointId);
+    }
   }
 
   if (!success && freeCallback != nullptr) {

diff --git a/core/include/chre/core/event.h b/core/include/chre/core/event.h
index ec7da16..0136a1b 100644
--- a/core/include/chre/core/event.h
+++ b/core/include/chre/core/event.h

@@ -39,7 +39,7 @@
 
 //! Default target group mask that results in the event being sent to any app
 //! registered for it.
-constexpr uint16_t kDefaultTargetGroupMask = UINT16_MAX;
+constexpr uint16_t kDefaultTargetGroupMask = 0;
 
 class Event : public NonCopyable {
  public:
@@ -61,7 +61,6 @@
         isLowPriority(isLowPriority_) {
     // Sending events to the system must only be done via the other constructor
     CHRE_ASSERT(targetInstanceId_ != kSystemInstanceId);
-    CHRE_ASSERT(targetAppGroupMask_ > 0);
   }
 
   // Alternative constructor used for system-internal events (e.g. deferred

diff --git a/core/nanoapp.cc b/core/nanoapp.cc
index 44009f7..427d8c1 100644
--- a/core/nanoapp.cc
+++ b/core/nanoapp.cc

@@ -69,7 +69,7 @@
     size_t foundIndex = registrationIndex(eventType);
     if (foundIndex < mRegisteredEvents.size()) {
       const EventRegistration &reg = mRegisteredEvents[foundIndex];
-      if (targetGroupIdMask & reg.groupIdMask) {
+      if ((targetGroupIdMask & reg.groupIdMask) == targetGroupIdMask) {
         registered = true;
       }
     }

diff --git a/test/simulation/chre_message_hub_test.cc b/test/simulation/chre_message_hub_test.cc
index cc59ae7..97c8ac6 100644
--- a/test/simulation/chre_message_hub_test.cc
+++ b/test/simulation/chre_message_hub_test.cc

@@ -690,7 +690,8 @@
             EXPECT_TRUE(chreMsgSend(
                 reinterpret_cast<void *>(kMessage), kMessageSize,
                 /* messageType= */ 1, mSessionId, CHRE_MESSAGE_PERMISSION_NONE,
-                /* freeCallback= */ nullptr));
+                /* freeCallback= */ [](void * /*message*/, size_t /*length*/) {
+                }));
             triggerWait(TEST_SEND_MESSAGE_NO_FREE_CALLBACK);
             break;
           }
@@ -698,7 +699,8 @@
             EXPECT_TRUE(chreMsgSend(
                 reinterpret_cast<void *>(kMessage), kMessageSize,
                 /* messageType= */ 1, mSessionId, CHRE_MESSAGE_PERMISSION_NONE,
-                /* freeCallback= */ nullptr));
+                /* freeCallback= */ [](void * /*message*/, size_t /*length*/) {
+                }));
             break;
           }
         }