Merge "speech: Check componentName maps to RecognitionService" into sc-dev
diff --git a/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java b/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
index eee08c2..264ef87 100644
--- a/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
+++ b/services/core/java/com/android/server/speech/SpeechRecognitionManagerServiceImpl.java
@@ -24,6 +24,7 @@
 import android.content.ComponentName;
 import android.content.Intent;
 import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
 import android.content.pm.ServiceInfo;
 import android.os.Binder;
 import android.os.IBinder;
@@ -31,6 +32,7 @@
 import android.speech.IRecognitionListener;
 import android.speech.IRecognitionService;
 import android.speech.IRecognitionServiceManagerCallback;
+import android.speech.RecognitionService;
 import android.speech.SpeechRecognizer;
 import android.util.Slog;
 
@@ -39,6 +41,7 @@
 
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
@@ -225,6 +228,10 @@
                 }
             }
 
+            if (serviceComponent != null && !componentMapsToRecognitionService(serviceComponent)) {
+                return null;
+            }
+
             RemoteSpeechRecognitionService service =
                     new RemoteSpeechRecognitionService(
                             getContext(), serviceComponent, getUserId(), callingUid);
@@ -241,6 +248,25 @@
         }
     }
 
+    private boolean componentMapsToRecognitionService(@NonNull ComponentName serviceComponent) {
+        List<ResolveInfo> resolveInfos =
+                getContext().getPackageManager().queryIntentServices(
+                        new Intent(RecognitionService.SERVICE_INTERFACE), 0);
+        if (resolveInfos == null) {
+            return false;
+        }
+
+        for (ResolveInfo ri : resolveInfos) {
+            if (ri.serviceInfo != null
+                    && serviceComponent.equals(ri.serviceInfo.getComponentName())) {
+                return true;
+            }
+        }
+
+        Slog.w(TAG, "serviceComponent is not RecognitionService: " + serviceComponent);
+        return false;
+    }
+
     private void removeService(int callingUid, RemoteSpeechRecognitionService service) {
         synchronized (mLock) {
             Set<RemoteSpeechRecognitionService> valuesByCaller =