Prevent loading of Icon resources from the wrong package

If an Icon carries package designator, LocalImageResolver has now
ignored it. This could lead to loading of a wrong icon in cases where
the ID collided with the same ID in android package.

This is fixes that corner-case.

Bug: 241066484
Test: atest LocalImageResolverTest - the new test checks for pkg
      correctness and fails on devices without this cl

      manual test: bluejay device with known, reproducible resource
      collision in media player notification. In reproducible case,
      icon appears as a broken block.

      After applying this patch, small icon in media notification loads
      correctly for the collision case.

Change-Id: Ic79c0d4acb1d347a24282972e009a5a079ce6c21
(cherry picked from commit 32f176e4705694c9d0272eba22887cf6d4f7b783)
Merged-In: Ic79c0d4acb1d347a24282972e009a5a079ce6c21

2 files changed, 16 insertions, 0 deletions

diff --git a/core/java/com/android/internal/widget/LocalImageResolver.java b/core/java/com/android/internal/widget/LocalImageResolver.java
index b866723954b5..b11ea2961c17 100644
--- a/core/java/com/android/internal/widget/LocalImageResolver.java
+++ b/core/java/com/android/internal/widget/LocalImageResolver.java
@@ -25,6 +25,7 @@ import android.graphics.ImageDecoder;
 import android.graphics.drawable.Drawable;
 import android.graphics.drawable.Icon;
 import android.net.Uri;
+import android.text.TextUtils;
 import android.util.Log;
 import android.util.Size;
 
@@ -108,6 +109,12 @@ public class LocalImageResolver {
                 }
                 break;
             case Icon.TYPE_RESOURCE:
+                if (!(TextUtils.isEmpty(icon.getResPackage())
+                        || context.getPackageName().equals(icon.getResPackage()))) {
+                    // We can't properly resolve icons from other packages here, so fall back.
+                    return icon.loadDrawable(context);
+                }
+
                 Drawable result = resolveImage(icon.getResId(), context, maxWidth, maxHeight);
                 if (result != null) {
                     return tintDrawable(icon, result);
diff --git a/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java b/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
index c63d18bfa531..0cee526651a6 100644
--- a/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
+++ b/core/tests/coretests/src/com/android/internal/widget/LocalImageResolverTest.java
@@ -270,4 +270,13 @@ public class LocalImageResolverTest {
         assertThat(bd.getBitmap().getHeight()).isEqualTo(originalHeight);
 
     }
+
+    @Test
+    public void resolveImage_iconWithOtherPackageResource_usesPackageContextDefinition()
+            throws IOException {
+        Icon icon = Icon.createWithResource("this_is_invalid", R.drawable.test32x24);
+        Drawable d = LocalImageResolver.resolveImage(icon, mContext);
+        // This drawable must not be loaded - if it was, the code ignored the package specification.
+        assertThat(d).isNull();
+    }
 }