commit 78301cb9b51f1fe948da71ac7f5f0b008f99d953
author Rambo Wang <rambowang@google.com> Tue May 10 13:01:13 2022 -0700
committer Rambo Wang <rambowang@google.com> Thu May 26 15:22:22 2022 -0700
tree 75fb76668f3c10f416a1247220e4544aceab095a
parent 19af8c33b25af663d749027f19c67bf705a71896

Fix the phone process crash due to null UiccPort object access

Method getUiccPortFromRequest may return null. Accessing the
returned UiccPort without NPC may cause phone process crash.

Add nullability annotation for the method and perform NPC
for the return object to fix the crash.

Bug: 232090208
Test: atest TelephonyManagerTest CarrierApiTest
Test: Manual sanity test on MT/MO call, SMS, Data, activation...on both pSIM and eSIM
Merged-In: Iea14a99b824ac67f8d006c7bc68c7dffa6ce1b9e
Change-Id: Iea14a99b824ac67f8d006c7bc68c7dffa6ce1b9e
(cherry picked from commit e53e07d9c1d30999f4d63662a6d30db390803b0e)

src/com/android/phone/PhoneInterfaceManager.java

diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 7b7be8a..ac70b4e 100755
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -750,10 +750,14 @@
                             IccOpenLogicalChannelResponse.STATUS_NO_ERROR, selectResponse);
 
                         uiccPort = getUiccPortFromRequest(request);
-                        IccLogicalChannelRequest channelRequest =
-                                (IccLogicalChannelRequest) request.argument;
-                        channelRequest.channel = channelId;
-                        uiccPort.onLogicalChannelOpened(channelRequest);
+                        if (uiccPort == null) {
+                            loge("EVENT_OPEN_CHANNEL_DONE: UiccPort is null");
+                        } else {
+                            IccLogicalChannelRequest channelRequest =
+                                    (IccLogicalChannelRequest) request.argument;
+                            channelRequest.channel = channelId;
+                            uiccPort.onLogicalChannelOpened(channelRequest);
+                        }
                     } else {
                         if (ar.result == null) {
                             loge("iccOpenLogicalChannel: Empty response");
@@ -797,8 +801,12 @@
                     if (ar.exception == null) {
                         request.result = true;
                         uiccPort = getUiccPortFromRequest(request);
-                        final int channelId = (Integer) request.argument;
-                        uiccPort.onLogicalChannelClosed(channelId);
+                        if (uiccPort == null) {
+                            loge("EVENT_CLOSE_CHANNEL_DONE: UiccPort is null");
+                        } else {
+                            final int channelId = (Integer) request.argument;
+                            uiccPort.onLogicalChannelClosed(channelId);
+                        }
                     } else {
                         request.result = false;
                         if (ar.exception instanceof CommandException) {
@@ -2365,7 +2373,8 @@
                 ? getDefaultPhone() : getPhone(subId);
     }
 
-    private UiccPort getUiccPortFromRequest(MainThreadRequest request) {
+    @Nullable
+    private UiccPort getUiccPortFromRequest(@NonNull MainThreadRequest request) {
         Phone phone = getPhoneFromRequest(request);
         return phone == null ? null :
                 UiccController.getInstance().getUiccPort(phone.getPhoneId());