Fix: ConnectivityManager methods crashing with SecurityException
Starting in R, some methods in ConnectivityManager like getNetworkCapabilities started passing the package name from the context stored in CM to check that the package is really whom it pretends to be. Unfortunately, in some cases, the context contains package "android" for an app, and since the app is not the system, the check fails and crashes the app. It seems the culprit is updateHttpProxy, which is called by ProcessList when the PROXY_CHANGE_ACTION broadcast is sent. If this happens to run between the time the process is created and the activity thread is "bound", then the mInitialApplication member is not set, and updateHttpProxy uses a system context. Since ConnectivityManager caches the context forever in a static, this leads to subsequent legitimate calls crashing. Setting the proxy can be deffered until such a time that the app is bound, as it can't run any code before then. The member is never reset to null, so it's guaranteed to be non-null at bind time. An alternative would be to post a runnable on the handler thread if the member is null to try again later. This could however run the lambda a considerable number of times as binding can be delayed, and risks causing an infinite loop if some invariants are changed in the future. See also b/73572062 and ag/4056059 Bug: 155549446 Bug: 189360509 Test: ActivityThreadTest FrameworksNetTests NetworkStackTests Test: Manually set a proxy, observe the broadcast being sent and apps not crashing Change-Id: I956f76be2e0a1a675576511fb394d7ed4354b28a (cherry picked from commit b0d13e29515d5b7c82daed7533b78ac57e46bd93)
Loading
Please register or sign in to comment