大土豆安全笔记 | 五月份公告几个框架层的漏洞

diff --git a/core/res/res/values/dimens.xml b/core/res/res/values/dimens.xml
+    <!--
+      The overridable minimal size of a PiP task, in both dimensions.
+      Different from default_minimal_size_pip_resizable_task, this is to limit the dimension
+      when the pinned stack size is overridden by app via minWidth/minHeight.
+    -->
+    <dimen name="overridable_minimal_size_pip_resizable_task">48dp</dimen>

diff --git a/packages/SystemUI/src/com/android/systemui/pip/PipTaskOrganizer.java b/packages/SystemUI/src/com/android/systemui/pip/PipTaskOrganizer.java
         if (windowLayout.minWidth > 0 && windowLayout.minHeight > 0) {
-            return new Size(windowLayout.minWidth, windowLayout.minHeight);
+            // If either dimension is smaller than the allowed minimum, adjust them
+            // according to mOverridableMinSize and log to SafeNet
+            if (windowLayout.minWidth < mOverridableMinSize
+                    || windowLayout.minHeight < mOverridableMinSize) {
+                EventLog.writeEvent(0x534e4554, "174302616", -1, "");
+            }
+            return new Size(Math.max(windowLayout.minWidth, mOverridableMinSize),
+                    Math.max(windowLayout.minHeight, mOverridableMinSize));

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
+    <uses-permission android:name="android.permission.HIDE_NON_SYSTEM_OVERLAY_WINDOWS" />

diff --git a/src/com/android/providers/calendar/CalendarDebugActivity.java b/src/com/android/providers/calendar/CalendarDebugActivity.java
+    @Override
+    protected void onStart() {
+        super.onStart();
+        getWindow().addSystemFlags(android.view.WindowManager.LayoutParams
+                .SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
+    }
+

diff --git a/packages/SystemUI/src/com/android/systemui/screenshot/ScreenshotNotificationsController.java b/packages/SystemUI/src/com/android/systemui/screenshot/ScreenshotNotificationsController.java
         if (intent != null) {
             final PendingIntent pendingIntent = PendingIntent.getActivityAsUser(
-                    mContext, 0, intent, 0, null, UserHandle.CURRENT);
+                    mContext, 0, intent, PendingIntent.FLAG_IMMUTABLE, null, UserHandle.CURRENT);
             b.setContentIntent(pendingIntent);
         }

diff --git a/src/com/android/settings/users/EditUserPhotoController.java b/src/com/android/settings/users/EditUserPhotoController.java
         final Uri pictureUri = data != null && data.getData() != null
                 ? data.getData() : mTakePictureUri;
+
+        // Check if the result is a content uri
+        if (!ContentResolver.SCHEME_CONTENT.equals(pictureUri.getScheme())) {
+            Log.e(TAG, "Invalid pictureUri scheme: " + pictureUri.getScheme());
+            EventLog.writeEvent(0x534e4554, "172939189", -1, pictureUri.getPath());
+            return false;
+        }
+

diff --git a/services/core/java/com/android/server/notification/SnoozeHelper.java b/services/core/java/com/android/server/notification/SnoozeHelper.java
         return PendingIntent.getBroadcast(mContext,
                 REQUEST_CODE_REPOST,
                 new Intent(REPOST_ACTION)
+                        .setPackage(PackageManagerService.PLATFORM_PACKAGE_NAME)
                         .setData(new Uri.Builder().scheme(REPOST_SCHEME).appendPath(key).build())
                         .addFlags(Intent.FLAG_RECEIVER_FOREGROUND)
                         .putExtra(EXTRA_KEY, key)

@Override
public boolean onCreateSliceProvider() {
    synchronized (this) {
        ...
        
        mPendingIntent = PendingIntent.getActivity(getContext(), 0, new Intent(), 0);
        
        ...
    }
    return true;
}

<provider
    android:name=".keyguard.KeyguardSliceProvider"
    android:authorities="com.android.systemui.keyguard"
    android:grantUriPermissions="true"
    android:exported="true">
</provider>

@Override
public Bundle call(String method, String arg, Bundle extras) {
    if (method.equals(METHOD_SLICE)) {
        Uri uri = getUriWithoutUserId(validateIncomingUriOrNull(
                extras.getParcelable(EXTRA_BIND_URI)));
        List<SliceSpec> supportedSpecs = extras.getParcelableArrayList(EXTRA_SUPPORTED_SPECS);
        String callingPackage = getCallingPackage();
        int callingUid = Binder.getCallingUid();
        int callingPid = Binder.getCallingPid();
        Slice s = handleBindSlice(uri, supportedSpecs, callingPackage, callingUid, callingPid);    // <-- 1
        Bundle b = new Bundle();
        b.putParcelable(EXTRA_SLICE, s);
        return b;
    } else if (method.equals(METHOD_MAP_INTENT)) {
        ...
    } else if(...) {
        ...
    }
    return super.call(method, arg, extras);
}