Make sure IME token verification is done inside a lock
This caller verification needs to be done in an atomic manner. There is a possible race condition in the following code. @BinderThread public boolean doSomething(IBinder imeToken, ...) { if (!calledWithValidToken(imeToken)) { return false; } // possible race condition here. synchronized(mMethodMap) { // actual operations } } Insted, we should check the IME token after taking a lock. @BinderThread public boolean doSomething(IBinder imeToken, ...) { synchronized(mMethodMap) { if (!calledWithValidTokenLocked(imeToken)) { return false; } // actual operations } } Bug: 34886274 Test: atest CtsInputMethodTestCases CtsInputMethodServiceHostTestCases Change-Id: Ia128b27de2cf16565c9c3fd40c5ac3be8e4eac42
Loading
Please register or sign in to comment