diff options
| -rw-r--r-- | services/core/java/com/android/server/wm/AppTransition.java | 1 | ||||
| -rw-r--r-- | services/core/java/com/android/server/wm/WindowManagerService.java | 12 |
2 files changed, 12 insertions, 1 deletions
diff --git a/services/core/java/com/android/server/wm/AppTransition.java b/services/core/java/com/android/server/wm/AppTransition.java index b1ed35867dcf..1d87b74023e4 100644 --- a/services/core/java/com/android/server/wm/AppTransition.java +++ b/services/core/java/com/android/server/wm/AppTransition.java @@ -176,6 +176,7 @@ public class AppTransition implements Dump { private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420; private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336; private static final long APP_TRANSITION_TIMEOUT_MS = 5000; + static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs. private final Context mContext; private final WindowManagerService mService; diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index 8439669a2147..bf488132e253 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -68,6 +68,7 @@ import static android.view.WindowManagerPolicy.FINISH_LAYOUT_REDO_LAYOUT; import static android.view.WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER; import static com.android.server.LockGuard.INDEX_WINDOW; import static com.android.server.LockGuard.installLock; +import static com.android.server.wm.AppTransition.MAX_APP_TRANSITION_DURATION; import static com.android.server.wm.AppTransition.TRANSIT_UNSET; import static com.android.server.wm.AppWindowAnimator.PROLONG_ANIMATION_AT_END; import static com.android.server.wm.AppWindowAnimator.PROLONG_ANIMATION_AT_START; @@ -2361,7 +2362,16 @@ public class WindowManagerService extends IWindowManager.Stub displayConfig.orientation, frame, displayFrame, insets, surfaceInsets, isVoiceInteraction, freeform, atoken.getTask().mTaskId); if (a != null) { - if (DEBUG_ANIM) logWithStack(TAG, "Loaded animation " + a + " for " + atoken); + if (a != null) { + // Setup the maximum app transition duration to prevent malicious app may set a long + // animation duration or infinite repeat counts for the app transition through + // ActivityOption#makeCustomAnimation or WindowManager#overridePendingTransition. + a.restrictDuration(MAX_APP_TRANSITION_DURATION); + } + if (DEBUG_ANIM) { + logWithStack(TAG, "Loaded animation " + a + " for " + atoken + + ", duration: " + ((a != null) ? a.getDuration() : 0)); + } final int containingWidth = frame.width(); final int containingHeight = frame.height(); atoken.mAppAnimator.setAnimation(a, containingWidth, containingHeight, width, |