commit e53e07d9c1d30999f4d63662a6d30db390803b0e
author Rambo Wang <rambowang@google.com> Tue May 10 13:01:13 2022 -0700
committer Rambo Wang <rambowang@google.com> Wed May 11 16:59:15 2022 +0000
tree b05c4b29e2c35381eafdf97c4fd5e4d8ffcea00c
parent f76bcd659d2943da654db16ebf0de96f75a5154b

Fix the phone process crash due to null UiccPort object access

Method getUiccPortFromRequest may return null. Accessing the
returned UiccPort without NPC may cause phone process crash.

Add nullability annotation for the method and perform NPC
for the return object to fix the crash.

Bug: 232090208
Test: atest TelephonyManagerTest CarrierApiTest
Test: Manual sanity test on MT/MO call, SMS, Data, activation...on both pSIM and eSIM
Change-Id: Iea14a99b824ac67f8d006c7bc68c7dffa6ce1b9e

src/com/android/phone/PhoneInterfaceManager.java

diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index bb38ef0..a5168ef 100755
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -751,10 +751,14 @@
                                 IccOpenLogicalChannelResponse.STATUS_NO_ERROR, selectResponse);
 
                         uiccPort = getUiccPortFromRequest(request);
-                        IccLogicalChannelRequest channelRequest =
-                                (IccLogicalChannelRequest) request.argument;
-                        channelRequest.channel = channelId;
-                        uiccPort.onLogicalChannelOpened(channelRequest);
+                        if (uiccPort == null) {
+                            loge("EVENT_OPEN_CHANNEL_DONE: UiccPort is null");
+                        } else {
+                            IccLogicalChannelRequest channelRequest =
+                                    (IccLogicalChannelRequest) request.argument;
+                            channelRequest.channel = channelId;
+                            uiccPort.onLogicalChannelOpened(channelRequest);
+                        }
                     } else {
                         if (ar.result == null) {
                             loge("iccOpenLogicalChannel: Empty response");
@@ -800,8 +804,12 @@
                     if (ar.exception == null) {
                         request.result = true;
                         uiccPort = getUiccPortFromRequest(request);
-                        final int channelId = (Integer) request.argument;
-                        uiccPort.onLogicalChannelClosed(channelId);
+                        if (uiccPort == null) {
+                            loge("EVENT_CLOSE_CHANNEL_DONE: UiccPort is null");
+                        } else {
+                            final int channelId = (Integer) request.argument;
+                            uiccPort.onLogicalChannelClosed(channelId);
+                        }
                     } else {
                         request.result = false;
                         Exception exception = null;
@@ -2369,7 +2377,8 @@
                 ? getDefaultPhone() : getPhone(subId);
     }
 
-    private UiccPort getUiccPortFromRequest(MainThreadRequest request) {
+    @Nullable
+    private UiccPort getUiccPortFromRequest(@NonNull MainThreadRequest request) {
         Phone phone = getPhoneFromRequest(request);
         return phone == null ? null :
                 UiccController.getInstance().getUiccPort(phone.getPhoneId());