From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Pinyao Ting Date: Thu, 29 Aug 2024 17:01:55 +0000 Subject: [PATCH] Properly handle onNullBinding() in appwidget service. Bug: 340239088 Test: manually verified with the PoC app Flag: EXEMPT CVE (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5b076641fc517b37f1689697130de3cbc22a4c92) Merged-In: I12fccb572e159a73785aa33a4f5204e094ccd1b7 Change-Id: I12fccb572e159a73785aa33a4f5204e094ccd1b7 --- core/java/android/widget/RemoteViewsAdapter.java | 5 +++++ .../android/server/appwidget/AppWidgetServiceImpl.java | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/core/java/android/widget/RemoteViewsAdapter.java b/core/java/android/widget/RemoteViewsAdapter.java index e58f08a79965..d64a3b5ee16b 100644 --- a/core/java/android/widget/RemoteViewsAdapter.java +++ b/core/java/android/widget/RemoteViewsAdapter.java @@ -238,6 +238,11 @@ public class RemoteViewsAdapter extends BaseAdapter implements Handler.Callback } } + @Override + public void onNullBinding(ComponentName name) { + enqueueDeferredUnbindServiceMessage(); + } + @Override public void handleMessage(Message msg) { RemoteViewsAdapter adapter = mAdapter.get(); diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java index f989f73b11b1..709a206a39c7 100644 --- a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java +++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java @@ -1888,6 +1888,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku mContext.unbindService(this); } + @Override + public void onNullBinding(ComponentName name) { + mContext.unbindService(this); + } + @Override public void onServiceDisconnected(ComponentName name) { // Do nothing @@ -2028,6 +2033,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku mContext.unbindService(this); } + @Override + public void onNullBinding(ComponentName name) { + mContext.unbindService(this); + } + @Override public void onServiceDisconnected(android.content.ComponentName name) { // Do nothing