Fix race condition in checkPattern and verifyPattern.

Bug: 31939282
Change-Id: I3250ab900f190ca9c820ac355ce94a699315b137

1 files changed, 19 insertions, 2 deletions

diff --git a/core/java/com/android/internal/widget/LockPatternChecker.java b/core/java/com/android/internal/widget/LockPatternChecker.java
index df9b0ddc1804..6defd1e8d9f2 100644
--- a/core/java/com/android/internal/widget/LockPatternChecker.java
+++ b/core/java/com/android/internal/widget/LockPatternChecker.java
@@ -4,6 +4,7 @@ import android.os.AsyncTask;
 
 import com.android.internal.widget.LockPatternUtils.RequestThrottledException;
 
+import java.util.ArrayList;
 import java.util.List;
 
 /**
@@ -61,11 +62,19 @@ public final class LockPatternChecker {
             final OnVerifyCallback callback) {
         AsyncTask<Void, Void, byte[]> task = new AsyncTask<Void, Void, byte[]>() {
             private int mThrottleTimeout;
+            private List<LockPatternView.Cell> patternCopy;
+
+            @Override
+            protected void onPreExecute() {
+                // Make a copy of the pattern to prevent race conditions.
+                // No need to clone the individual cells because they are immutable.
+                patternCopy = new ArrayList(pattern);
+            }
 
             @Override
             protected byte[] doInBackground(Void... args) {
                 try {
-                    return utils.verifyPattern(pattern, challenge, userId);
+                    return utils.verifyPattern(patternCopy, challenge, userId);
                 } catch (RequestThrottledException ex) {
                     mThrottleTimeout = ex.getTimeoutMs();
                     return null;
@@ -95,11 +104,19 @@ public final class LockPatternChecker {
             final OnCheckCallback callback) {
         AsyncTask<Void, Void, Boolean> task = new AsyncTask<Void, Void, Boolean>() {
             private int mThrottleTimeout;
+            private List<LockPatternView.Cell> patternCopy;
+
+            @Override
+            protected void onPreExecute() {
+                // Make a copy of the pattern to prevent race conditions.
+                // No need to clone the individual cells because they are immutable.
+                patternCopy = new ArrayList(pattern);
+            }
 
             @Override
             protected Boolean doInBackground(Void... args) {
                 try {
-                    return utils.checkPattern(pattern, userId, callback::onEarlyMatched);
+                    return utils.checkPattern(patternCopy, userId, callback::onEarlyMatched);
                 } catch (RequestThrottledException ex) {
                     mThrottleTimeout = ex.getTimeoutMs();
                     return false;