diff options
| -rw-r--r-- | core/java/android/view/InputChannel.java | 7 | ||||
| -rw-r--r-- | core/java/android/view/ViewRootImpl.java | 7 | ||||
| -rw-r--r-- | services/core/java/com/android/server/wm/WindowManagerService.java | 9 |
3 files changed, 16 insertions, 7 deletions
diff --git a/core/java/android/view/InputChannel.java b/core/java/android/view/InputChannel.java index ecb727c79016..346628bbdabd 100644 --- a/core/java/android/view/InputChannel.java +++ b/core/java/android/view/InputChannel.java @@ -111,6 +111,13 @@ public final class InputChannel implements Parcelable { } /** + * @hide + */ + public boolean isValid() { + return mPtr != 0; + } + + /** * Disposes the input channel. * Explicitly releases the reference this object is holding on the input channel. * When all references are released, the input channel will be closed. diff --git a/core/java/android/view/ViewRootImpl.java b/core/java/android/view/ViewRootImpl.java index 57a01a32e1b8..afc4ff437778 100644 --- a/core/java/android/view/ViewRootImpl.java +++ b/core/java/android/view/ViewRootImpl.java @@ -875,10 +875,7 @@ public final class ViewRootImpl implements ViewParent, // manager, to make sure we do the relayout before receiving // any other events from the system. requestLayout(); - if ((mWindowAttributes.inputFeatures - & WindowManager.LayoutParams.INPUT_FEATURE_NO_INPUT_CHANNEL) == 0) { - mInputChannel = new InputChannel(); - } + mInputChannel = new InputChannel(); mForceDecorViewVisibility = (mWindowAttributes.privateFlags & PRIVATE_FLAG_FORCE_DECOR_VIEW_VISIBILITY) != 0; try { @@ -971,7 +968,7 @@ public final class ViewRootImpl implements ViewParent, mInputQueueCallback = ((RootViewSurfaceTaker)view).willYouTakeTheInputQueue(); } - if (mInputChannel != null) { + if (mInputChannel.isValid()) { if (mInputQueueCallback != null) { mInputQueue = new InputQueue(); mInputQueueCallback.onInputQueueCreated(mInputQueue); diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index a9f157d985a6..d08533e3ee03 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -1462,8 +1462,13 @@ public class WindowManagerService extends IWindowManager.Stub return res; } - final boolean openInputChannels = (outInputChannel != null - && (attrs.inputFeatures & INPUT_FEATURE_NO_INPUT_CHANNEL) == 0); + boolean openInputChannels = (outInputChannel != null + && (attrs.inputFeatures & INPUT_FEATURE_NO_INPUT_CHANNEL) == 0); + if (callingUid != SYSTEM_UID) { + Slog.e(TAG_WM, + "App trying to use insecure INPUT_FEATURE_NO_INPUT_CHANNEL flag. Ignoring"); + openInputChannels = true; + } if (openInputChannels) { win.openInputChannel(outInputChannel); } |