don't blindly reuse content providers

when a provider is already running, we would automatically
give it out to other processes that request it. for instant
apps, don't do that.

Change-Id: I159913adc599e88dac6253104776589592b251fd
Fixes: 37501319
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest

1 files changed, 4 insertions, 0 deletions

diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 8f1afa87b6a6..e3f4370951ea 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -11252,6 +11252,10 @@ public class ActivityManagerService extends IActivityManager.Stub
                     holder.provider = null;
                     return holder;
                 }
+                // Don't expose instant app providers
+                if (cpr.appInfo.isInstantApp()) {
+                    return null;
+                }
 
                 final long origId = Binder.clearCallingIdentity();