From 7e04887e5945c193bd5abf92ec6092b3a2295a04 Mon Sep 17 00:00:00 2001
From: Jon Miranda <jonmiranda@google.com>
Date: Fri, 8 Nov 2019 13:02:52 -0800
Subject: [PATCH] Address SessionCommitReceiver vulnerability by validating
 intent.

Bug: 144081762
Change-Id: I28699d26abefc716e57c281c15699f15003229b2
---
 src/com/android/launcher3/SessionCommitReceiver.java | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/com/android/launcher3/SessionCommitReceiver.java b/src/com/android/launcher3/SessionCommitReceiver.java
index 6853bf6941..a87c446585 100644
--- a/src/com/android/launcher3/SessionCommitReceiver.java
+++ b/src/com/android/launcher3/SessionCommitReceiver.java
@@ -71,8 +71,13 @@ public class SessionCommitReceiver extends BroadcastReceiver {
 
         SessionInfo info = intent.getParcelableExtra(PackageInstaller.EXTRA_SESSION);
         UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
-        PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);
+        if (!PackageInstaller.ACTION_SESSION_COMMITTED.equals(intent.getAction())
+                || info == null || user == null) {
+            // Invalid intent.
+            return;
+        }
 
+        PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);
         if (TextUtils.isEmpty(info.getAppPackageName())
                 || info.getInstallReason() != PackageManager.INSTALL_REASON_USER
                 || packageInstallerCompat.promiseIconAddedForId(info.getSessionId())) {