Merge "[Bugfix]Switch back to the application on /system when UID and path changed"
diff --git a/Android.bp b/Android.bp
index 55d9c4b..b30851c 100644
--- a/Android.bp
+++ b/Android.bp
@@ -97,7 +97,7 @@
// AIDL sources from external directories
":android.hardware.gnss-V2-java-source",
":android.hardware.graphics.common-V3-java-source",
- ":android.hardware.security.keymint-V2-java-source",
+ ":android.hardware.security.keymint-V3-java-source",
":android.hardware.security.secureclock-V1-java-source",
":android.hardware.tv.tuner-V1-java-source",
":android.security.apc-java-source",
diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index 8af0d01..86e9610 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -764,6 +764,9 @@
method public static android.app.BroadcastOptions makeBasic();
method @RequiresPermission(android.Manifest.permission.ACCESS_BROADCAST_RESPONSE_STATS) public void recordResponseEventWhileInBackground(@IntRange(from=0) long);
method @RequiresPermission(android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND) public void setBackgroundActivityStartsAllowed(boolean);
+ method public void setDeliveryGroupMatchingFilter(@NonNull android.content.IntentFilter);
+ method public void setDeliveryGroupMatchingKey(@NonNull String, @NonNull String);
+ method public void setDeliveryGroupPolicy(int);
method public void setDontSendToRestrictedApps(boolean);
method public void setPendingIntentBackgroundActivityLaunchAllowed(boolean);
method public void setRequireAllOfPermissions(@Nullable String[]);
@@ -772,6 +775,8 @@
method @RequiresPermission(anyOf={android.Manifest.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST, android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND, android.Manifest.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND}) public void setTemporaryAppAllowlist(long, int, int, @Nullable String);
method @Deprecated @RequiresPermission(anyOf={android.Manifest.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST, android.Manifest.permission.START_ACTIVITIES_FROM_BACKGROUND, android.Manifest.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND}) public void setTemporaryAppWhitelistDuration(long);
method public android.os.Bundle toBundle();
+ field public static final int DELIVERY_GROUP_POLICY_ALL = 0; // 0x0
+ field public static final int DELIVERY_GROUP_POLICY_MOST_RECENT = 1; // 0x1
}
public class DownloadManager {
diff --git a/core/java/Android.bp b/core/java/Android.bp
index eac8b9b..88ee39d 100644
--- a/core/java/Android.bp
+++ b/core/java/Android.bp
@@ -425,6 +425,16 @@
],
}
+// This file group is used by service fuzzer
+filegroup {
+ name: "framework-core-sources-for-fuzzers",
+ srcs: [
+ "android/os/IInterface.java",
+ "android/os/Binder.java",
+ "android/os/IBinder.java",
+ ],
+}
+
aidl_interface {
name: "android.os.statsbootstrap_aidl",
unstable: true,
diff --git a/core/java/android/app/BroadcastOptions.java b/core/java/android/app/BroadcastOptions.java
index 56f8760..a504034 100644
--- a/core/java/android/app/BroadcastOptions.java
+++ b/core/java/android/app/BroadcastOptions.java
@@ -16,6 +16,7 @@
package android.app;
+import android.annotation.IntDef;
import android.annotation.IntRange;
import android.annotation.NonNull;
import android.annotation.Nullable;
@@ -27,12 +28,19 @@
import android.compat.annotation.Disabled;
import android.compat.annotation.EnabledSince;
import android.content.Intent;
+import android.content.IntentFilter;
import android.os.Build;
import android.os.Bundle;
import android.os.PowerExemptionManager;
import android.os.PowerExemptionManager.ReasonCode;
import android.os.PowerExemptionManager.TempAllowListType;
+import com.android.internal.util.Preconditions;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.util.Objects;
+
/**
* Helper class for building an options Bundle that can be used with
* {@link android.content.Context#sendBroadcast(android.content.Intent)
@@ -54,6 +62,9 @@
private long mRequireCompatChangeId = CHANGE_INVALID;
private boolean mRequireCompatChangeEnabled = true;
private long mIdForResponseEvent;
+ private @DeliveryGroupPolicy int mDeliveryGroupPolicy;
+ private @Nullable String mDeliveryGroupMatchingKey;
+ private @Nullable IntentFilter mDeliveryGroupMatchingFilter;
/**
* Change ID which is invalid.
@@ -172,6 +183,36 @@
private static final String KEY_ID_FOR_RESPONSE_EVENT =
"android:broadcast.idForResponseEvent";
+ /**
+ * The list of delivery group policies which specify how multiple broadcasts belonging to
+ * the same delivery group has to be handled.
+ * @hide
+ */
+ @IntDef(flag = true, prefix = { "DELIVERY_GROUP_POLICY_" }, value = {
+ DELIVERY_GROUP_POLICY_ALL,
+ DELIVERY_GROUP_POLICY_MOST_RECENT,
+ })
+ @Retention(RetentionPolicy.SOURCE)
+ public @interface DeliveryGroupPolicy {}
+
+ /**
+ * Delivery group policy that indicates that all the broadcasts in the delivery group
+ * need to be delivered as is.
+ *
+ * @hide
+ */
+ @SystemApi
+ public static final int DELIVERY_GROUP_POLICY_ALL = 0;
+
+ /**
+ * Delivery group policy that indicates that only the most recent broadcast in the delivery
+ * group need to be delivered and the rest can be dropped.
+ *
+ * @hide
+ */
+ @SystemApi
+ public static final int DELIVERY_GROUP_POLICY_MOST_RECENT = 1;
+
public static BroadcastOptions makeBasic() {
BroadcastOptions opts = new BroadcastOptions();
return opts;
@@ -544,6 +585,57 @@
}
/**
+ * Set delivery group policy for this broadcast to specify how multiple broadcasts belonging to
+ * the same delivery group has to be handled.
+ *
+ * @hide
+ */
+ @SystemApi
+ public void setDeliveryGroupPolicy(@DeliveryGroupPolicy int policy) {
+ mDeliveryGroupPolicy = policy;
+ }
+
+ /**
+ * Set namespace and key to identify the delivery group that this broadcast belongs to.
+ *
+ * <p> If {@code namespace} and {@code key} are specified, then another broadcast will be
+ * considered to be in the same delivery group as this iff it has the same {@code namespace}
+ * and {@code key}.
+ *
+ * <p> If neither matching key using this API nor matching filter using
+ * {@link #setDeliveryGroupMatchingFilter(IntentFilter)} is specified, then by default
+ * {@link Intent#filterEquals(Intent)} will be used to identify the delivery group.
+ *
+ * @hide
+ */
+ @SystemApi
+ public void setDeliveryGroupMatchingKey(@NonNull String namespace, @NonNull String key) {
+ Preconditions.checkArgument(!namespace.contains("/"),
+ "namespace should not contain '/'");
+ Preconditions.checkArgument(!key.contains("/"),
+ "key should not contain '/'");
+ mDeliveryGroupMatchingKey = namespace + "/" + key;
+ }
+
+ /**
+ * Set the {@link IntentFilter} object to identify the delivery group that this broadcast
+ * belongs to.
+ *
+ * <p> If a {@code matchingFilter} is specified, then another broadcast will be considered
+ * to be in the same delivery group as this iff the {@code matchingFilter} matches it's intent.
+ *
+ * <p> If neither matching key using {@link #setDeliveryGroupMatchingKey(String, String)} nor
+ * matching filter using this API is specified, then by default
+ * {@link Intent#filterEquals(Intent)} will be used to identify the delivery group.
+ *
+ * @hide
+ */
+ @SystemApi
+ public void setDeliveryGroupMatchingFilter(@NonNull IntentFilter matchingFilter) {
+ mDeliveryGroupMatchingFilter = Objects.requireNonNull(matchingFilter);
+ }
+
+ /**
* Returns the created options as a Bundle, which can be passed to
* {@link android.content.Context#sendBroadcast(android.content.Intent)
* Context.sendBroadcast(Intent)} and related methods.
diff --git a/core/java/android/os/ServiceManager.java b/core/java/android/os/ServiceManager.java
index 9ea4278..394927e 100644
--- a/core/java/android/os/ServiceManager.java
+++ b/core/java/android/os/ServiceManager.java
@@ -252,10 +252,12 @@
}
/**
- * Returns the list of declared instances for an interface.
+ * Returns an array of all declared instances for a particular interface.
*
- * @return true if the service is declared somewhere (eg. VINTF manifest) and
- * waitForService should always be able to return the service.
+ * For instance, if 'android.foo.IFoo/foo' is declared (e.g. in VINTF
+ * manifest), and 'android.foo.IFoo' is passed here, then ["foo"] would be
+ * returned.
+ *
* @hide
*/
@SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
diff --git a/core/jni/Android.bp b/core/jni/Android.bp
index 7cd7d29..681f194 100644
--- a/core/jni/Android.bp
+++ b/core/jni/Android.bp
@@ -40,6 +40,8 @@
cppflags: ["-Wno-conversion-null"],
+ cpp_std: "gnu++20",
+
srcs: [
"android_animation_PropertyValuesHolder.cpp",
"android_os_SystemClock.cpp",
diff --git a/core/tests/fuzzers/FuzzService/Android.bp b/core/tests/fuzzers/FuzzService/Android.bp
new file mode 100644
index 0000000..5093185
--- /dev/null
+++ b/core/tests/fuzzers/FuzzService/Android.bp
@@ -0,0 +1,28 @@
+package {
+ default_applicable_licenses: ["frameworks_base_license"],
+}
+
+java_library {
+ name: "random_parcel_lib",
+ srcs: ["FuzzBinder.java"],
+}
+
+cc_library_shared {
+ name: "librandom_parcel_jni",
+ defaults: ["service_fuzzer_defaults"],
+ srcs: [
+ "random_parcel_jni.cpp",
+ ],
+ shared_libs: [
+ "libandroid_runtime",
+ "libbase",
+ "liblog",
+ ],
+ static_libs: [
+ "libnativehelper_lazy",
+ "libbinder_random_parcel",
+ ],
+ cflags: [
+ "-Wno-unused-parameter",
+ ],
+}
diff --git a/core/tests/fuzzers/FuzzService/FuzzBinder.java b/core/tests/fuzzers/FuzzService/FuzzBinder.java
new file mode 100644
index 0000000..7096f52
--- /dev/null
+++ b/core/tests/fuzzers/FuzzService/FuzzBinder.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package randomparcel;
+import android.os.IBinder;
+
+public class FuzzBinder {
+ static {
+ System.loadLibrary("random_parcel_jni");
+ }
+
+ // DO NOT REUSE: This API should be called from fuzzer to setup JNI dependencies from
+ // libandroid_runtime. THIS IS WORKAROUND. Please file a bug if you need to use this.
+ public static void init() {
+ System.loadLibrary("android_runtime");
+ registerNatives();
+ }
+
+ // This API automatically fuzzes provided service
+ public static void fuzzService(IBinder binder, byte[] data) {
+ fuzzServiceInternal(binder, data);
+ }
+
+ private static native void fuzzServiceInternal(IBinder binder, byte[] data);
+ private static native int registerNatives();
+}
diff --git a/core/tests/fuzzers/FuzzService/random_parcel_jni.cpp b/core/tests/fuzzers/FuzzService/random_parcel_jni.cpp
new file mode 100644
index 0000000..c0528d5
--- /dev/null
+++ b/core/tests/fuzzers/FuzzService/random_parcel_jni.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "random_parcel_jni.h"
+#include <android_util_Binder.h>
+#include <fuzzbinder/libbinder_driver.h>
+#include <fuzzer/FuzzedDataProvider.h>
+using namespace android;
+
+// JNI interface for fuzzService
+JNIEXPORT void JNICALL Java_randomparcel_FuzzBinder_fuzzServiceInternal(JNIEnv *env, jobject thiz, jobject javaBinder, jbyteArray fuzzData) {
+ size_t len = static_cast<size_t>(env->GetArrayLength(fuzzData));
+ uint8_t data[len];
+ env->GetByteArrayRegion(fuzzData, 0, len, reinterpret_cast<jbyte*>(data));
+
+ FuzzedDataProvider provider(data, len);
+ sp<IBinder> binder = android::ibinderForJavaObject(env, javaBinder);
+ fuzzService(binder, std::move(provider));
+}
+
+// API used by AIDL fuzzers to access JNI functions from libandroid_runtime.
+JNIEXPORT jint JNICALL Java_randomparcel_FuzzBinder_registerNatives(JNIEnv* env) {
+ return registerFrameworkNatives(env);
+}
diff --git a/core/tests/fuzzers/FuzzService/random_parcel_jni.h b/core/tests/fuzzers/FuzzService/random_parcel_jni.h
new file mode 100644
index 0000000..20a4c9d
--- /dev/null
+++ b/core/tests/fuzzers/FuzzService/random_parcel_jni.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <jni.h>
+
+extern "C" {
+ JNIEXPORT void JNICALL Java_randomparcel_FuzzBinder_fuzzServiceInternal(JNIEnv *env, jobject thiz, jobject javaBinder, jbyteArray fuzzData);
+
+ // Function to register libandroid_runtime JNI functions with java env.
+ JNIEXPORT jint JNICALL Java_randomparcel_FuzzBinder_registerNatives(JNIEnv* env);
+
+ // Function from AndroidRuntime
+ jint registerFrameworkNatives(JNIEnv* env);
+}
diff --git a/core/tests/fuzzers/OWNERS b/core/tests/fuzzers/OWNERS
new file mode 100644
index 0000000..b972ac0
--- /dev/null
+++ b/core/tests/fuzzers/OWNERS
@@ -0,0 +1,2 @@
+smoreland@google.com
+waghpawan@google.com
diff --git a/core/tests/fuzzers/java_service_fuzzer/Android.bp b/core/tests/fuzzers/java_service_fuzzer/Android.bp
new file mode 100644
index 0000000..625de14
--- /dev/null
+++ b/core/tests/fuzzers/java_service_fuzzer/Android.bp
@@ -0,0 +1,40 @@
+package {
+ default_applicable_licenses: ["frameworks_base_license"],
+}
+
+aidl_interface {
+ name: "fuzzTestInterface",
+ srcs: ["fuzztest/ITestService.aidl"],
+ unstable: true,
+ backend: {
+ java: {
+ enabled: true,
+ },
+ },
+}
+
+java_fuzz {
+ name: "java_binder_service_fuzzer",
+ srcs: [
+ "ServiceFuzzer.java",
+ "TestService.java",
+ ":framework-core-sources-for-fuzzers",
+ ],
+ static_libs: [
+ "jazzer",
+ "fuzzTestInterface-java",
+ "random_parcel_lib",
+ ],
+ jni_libs: [
+ "librandom_parcel_jni",
+ "libc++",
+ "libandroid_runtime",
+ ],
+ libs: [
+ "framework",
+ "unsupportedappusage",
+ "ext",
+ "framework-res",
+ ],
+ native_bridge_supported: true,
+}
diff --git a/core/tests/fuzzers/java_service_fuzzer/ServiceFuzzer.java b/core/tests/fuzzers/java_service_fuzzer/ServiceFuzzer.java
new file mode 100644
index 0000000..a6e0986
--- /dev/null
+++ b/core/tests/fuzzers/java_service_fuzzer/ServiceFuzzer.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+
+import randomparcel.FuzzBinder;
+
+public class ServiceFuzzer {
+
+ static {
+ // Initialize fuzzService and JNI dependencies
+ FuzzBinder.init();
+ }
+
+ public static void fuzzerTestOneInput(FuzzedDataProvider data) {
+ TestService service = new TestService();
+ FuzzBinder.fuzzService(service, data.consumeRemainingAsBytes());
+ }
+}
diff --git a/core/tests/fuzzers/java_service_fuzzer/TestService.java b/core/tests/fuzzers/java_service_fuzzer/TestService.java
new file mode 100644
index 0000000..4404386
--- /dev/null
+++ b/core/tests/fuzzers/java_service_fuzzer/TestService.java
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fuzztest.ITestService;
+
+public class TestService extends ITestService.Stub {
+
+ @Override
+ public boolean repeatData(boolean token) {
+ return token;
+ }
+}
diff --git a/core/tests/fuzzers/java_service_fuzzer/fuzztest/ITestService.aidl b/core/tests/fuzzers/java_service_fuzzer/fuzztest/ITestService.aidl
new file mode 100644
index 0000000..b766c9f
--- /dev/null
+++ b/core/tests/fuzzers/java_service_fuzzer/fuzztest/ITestService.aidl
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package fuzztest;
+
+interface ITestService {
+ boolean repeatData(boolean token);
+}
\ No newline at end of file
diff --git a/data/keyboards/Generic.kl b/data/keyboards/Generic.kl
index 8e7c6a8..76b12677 100644
--- a/data/keyboards/Generic.kl
+++ b/data/keyboards/Generic.kl
@@ -363,6 +363,10 @@
# key 413 "KEY_DIGITS"
# key 414 "KEY_TEEN"
# key 415 "KEY_TWEN"
+# key 418 "KEY_ZOOM_IN"
+key 418 ZOOM_IN
+# key 419 "KEY_ZOOM_OUT"
+key 419 ZOOM_OUT
key 528 FOCUS
key 429 CONTACTS
diff --git a/native/android/Android.bp b/native/android/Android.bp
index 8594ba5..f1b1d79 100644
--- a/native/android/Android.bp
+++ b/native/android/Android.bp
@@ -34,6 +34,7 @@
cc_defaults {
name: "libandroid_defaults",
+ cpp_std: "gnu++20",
cflags: [
"-Wall",
"-Werror",
diff --git a/native/android/system_fonts.cpp b/native/android/system_fonts.cpp
index 9fe7929..8e90a65 100644
--- a/native/android/system_fonts.cpp
+++ b/native/android/system_fonts.cpp
@@ -66,9 +66,6 @@
return mFilePath == o.mFilePath && mLocale == o.mLocale && mWeight == o.mWeight &&
mItalic == o.mItalic && mCollectionIndex == o.mCollectionIndex && mAxes == o.mAxes;
}
-
- AFont() = default;
- AFont(const AFont&) = default;
};
struct FontHasher {