Clear binder identity when sending window change accessibility events.

We get calls for window changes from the window manager and
as a result send accessibility events for these changes. It
is possible that the call for a windows change from the window
manager comes as a result of an unprivileged client calling
into the window manager. However, the event sending code
is performing security checks.

bug:17364244

Change-Id: Ief016f9dafd13ac35418676817848b3ea3ed4d66

1 files changed, 10 insertions, 5 deletions

diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index 5d13fed..a43a2a6 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -3484,11 +3484,16 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
         }
 
         private void notifyWindowsChanged() {
-            // Let the client know the windows changed.
-            AccessibilityEvent event = AccessibilityEvent.obtain(
-                    AccessibilityEvent.TYPE_WINDOWS_CHANGED);
-            event.setEventTime(SystemClock.uptimeMillis());
-            sendAccessibilityEvent(event, mCurrentUserId);
+            final long identity = Binder.clearCallingIdentity();
+            try {
+                // Let the client know the windows changed.
+                AccessibilityEvent event = AccessibilityEvent.obtain(
+                        AccessibilityEvent.TYPE_WINDOWS_CHANGED);
+                event.setEventTime(SystemClock.uptimeMillis());
+                sendAccessibilityEvent(event, mCurrentUserId);
+            } finally {
+                Binder.restoreCallingIdentity(identity);
+            }
         }
 
         public boolean canGetAccessibilityNodeInfoLocked(Service service, int windowId) {