DivestOS/Patches/LineageOS-16.0/android_frameworks_base/411934.patch

From 5052b6ded1d3b0451c59a3b7537ab8e87274991b Mon Sep 17 00:00:00 2001
From: Pinyao Ting <pinyaoting@google.com>
Date: Thu, 29 Aug 2024 17:01:55 +0000
Subject: [PATCH] Properly handle onNullBinding() in appwidget service.

Bug: 340239088
Test: manually verified with the PoC app
Flag: EXEMPT CVE
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5b076641fc517b37f1689697130de3cbc22a4c92)
Merged-In: I12fccb572e159a73785aa33a4f5204e094ccd1b7
Change-Id: I12fccb572e159a73785aa33a4f5204e094ccd1b7
---
 core/java/android/widget/RemoteViewsAdapter.java       |  5 +++++
 .../android/server/appwidget/AppWidgetServiceImpl.java | 10 ++++++++++
 2 files changed, 15 insertions(+)

diff --git a/core/java/android/widget/RemoteViewsAdapter.java b/core/java/android/widget/RemoteViewsAdapter.java
index e5ae0ca0070c3..797689beb5825 100644
--- a/core/java/android/widget/RemoteViewsAdapter.java
+++ b/core/java/android/widget/RemoteViewsAdapter.java
@@ -229,6 +229,11 @@ public void onServiceDisconnected(ComponentName name) {
             }
         }
 
+        @Override
+        public void onNullBinding(ComponentName name) {
+            enqueueDeferredUnbindServiceMessage();
+        }
+
         @Override
         public void handleMessage(Message msg) {
             RemoteViewsAdapter adapter = mAdapter.get();
diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
index 9c18029ec693e..ba1eacad39352 100644
--- a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
+++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
@@ -1872,6 +1872,11 @@ public void onServiceConnected(ComponentName name, IBinder service) {
                 mContext.unbindService(this);
             }
 
+            @Override
+            public void onNullBinding(ComponentName name) {
+                mContext.unbindService(this);
+            }
+
             @Override
             public void onServiceDisconnected(ComponentName name) {
                 // Do nothing
@@ -2013,6 +2018,11 @@ public void onServiceConnected(ComponentName name, IBinder service) {
                                 mContext.unbindService(this);
                             }
 
+                            @Override
+                            public void onNullBinding(ComponentName name) {
+                                mContext.unbindService(this);
+                            }
+
                             @Override
                             public void onServiceDisconnected(android.content.ComponentName name) {
                                 // Do nothing