diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index ea44511..f1e637c 100644
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -2393,7 +2393,8 @@
 
     @Override
     public String getLine1NumberForDisplay(int subId, String callingPackage) {
-        if (!canReadPhoneState(callingPackage, "getLine1NumberForDisplay")) {
+        // This is open to apps with WRITE_SMS.
+        if (!canReadPhoneNumber(callingPackage, "getLine1NumberForDisplay")) {
             return null;
         }
 
@@ -2674,6 +2675,16 @@
         return true;
     }
 
+    /**
+     * Besides READ_PHONE_STATE, WRITE_SMS also allows apps to get phone numbers.
+     */
+    private boolean canReadPhoneNumber(String callingPackage, String message) {
+        // Note canReadPhoneState() may throw, so we need to do the appops check first.
+        return (mAppOps.noteOp(AppOpsManager.OP_WRITE_SMS,
+                        Binder.getCallingUid(), callingPackage) == AppOpsManager.MODE_ALLOWED)
+                || canReadPhoneState(callingPackage, message);
+    }
+
     @Override
     public void factoryReset(int subId) {
         enforceConnectivityInternalPermission();