Merge "Enforce ComponentName belongs to caller app" into rvc-dev am: c4d258d8b1

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/19497893

Change-Id: I8459e2027cccec768411b8be9d5b812647161bba
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/services/core/java/com/android/server/media/MediaSessionRecord.java b/services/core/java/com/android/server/media/MediaSessionRecord.java
index 348e9c1..4ba43f9 100644
--- a/services/core/java/com/android/server/media/MediaSessionRecord.java
+++ b/services/core/java/com/android/server/media/MediaSessionRecord.java
@@ -18,6 +18,7 @@
 
 import android.annotation.Nullable;
 import android.app.PendingIntent;
+import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.ParceledListSlice;
@@ -49,6 +50,8 @@
 import android.os.RemoteException;
 import android.os.ResultReceiver;
 import android.os.SystemClock;
+import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 import android.util.Slog;
 import android.view.KeyEvent;
@@ -834,10 +837,30 @@
             mHandler.post(MessageHandler.MSG_UPDATE_SESSION_STATE);
         }
 
+        private boolean checkComponentNamePackage(PendingIntent pi, String packageName) {
+            ComponentName componentName = null;
+            if (pi != null && pi.getIntent() != null) {
+                componentName = pi.getIntent().getComponent();
+            }
+
+            if(componentName != null
+                   && !TextUtils.equals(packageName, componentName.getPackageName())) {
+                return false;
+            }
+
+            return true;
+        }
+
         @Override
         public void setMediaButtonReceiver(PendingIntent pi) throws RemoteException {
             final long token = Binder.clearCallingIdentity();
             try {
+                if (!checkComponentNamePackage(pi, mPackageName)) {
+                    EventLog.writeEvent(0x534e4554, "238177121", -1, ""); // SafetyNet logging
+                    throw new IllegalArgumentException("Component Name package does not match "
+                            + "package name provided to MediaSessionRecord.");
+                }
+
                 if ((mPolicies & SessionPolicyProvider.SESSION_POLICY_IGNORE_BUTTON_RECEIVER)
                         != 0) {
                     return;