commit f1047e87767be1acd2c32f4d36028d1d0014f4c0
author Eric Laurent <elaurent@google.com> Mon Apr 16 19:18:20 2018 -0700
committer Eric Laurent <elaurent@google.com> Tue Apr 17 09:45:32 2018 -0700
tree 4affc2ed3ee3f81e94f90dd4d3a012afa0ee364e
parent 554e08c6b00b2a57348f4545d450915a9e8c870a

audioflinger: filter out reserved keys from setParameters()

Only allow setParameters() for reserved keys when received from
audioserver UID. For instance, keys used to control routing or audio
stream configuration are reserved for use by audio policy manager.

Also use multiuser_get_app_id() instead of duplicated code to
extract application ID from UID.

Bug: 77869640
Test: manual audio smoke tests.
Change-Id: I88852e8fddf7f705e4a084fc02d9ced1f4b0de92

media/libaudioclient/IAudioFlinger.cpp

diff --git a/media/libaudioclient/IAudioFlinger.cpp b/media/libaudioclient/IAudioFlinger.cpp
index 77cfe4d..8c9d3c1 100644
--- a/media/libaudioclient/IAudioFlinger.cpp
+++ b/media/libaudioclient/IAudioFlinger.cpp
@@ -24,6 +24,7 @@
 
 #include <binder/IPCThreadState.h>
 #include <binder/Parcel.h>
+#include <cutils/multiuser.h>
 #include <media/TimeCheck.h>
 #include <private/android_filesystem_config.h>
 
@@ -904,8 +905,7 @@
         case SET_MIC_MUTE:
         case SET_LOW_RAM_DEVICE:
         case SYSTEM_READY: {
-            uid_t multiUserClientUid = IPCThreadState::self()->getCallingUid() % AID_USER_OFFSET;
-            if (multiUserClientUid >= AID_APP_START) {
+            if (multiuser_get_app_id(IPCThreadState::self()->getCallingUid()) >= AID_APP_START) {
                 ALOGW("%s: transaction %d received from PID %d unauthorized UID %d",
                       __func__, code, IPCThreadState::self()->getCallingPid(),
                       IPCThreadState::self()->getCallingUid());