Media provider clears binder id calling in other providers

The media provider can call into the downloads provider which
runs in the same process from an IPC. In this case the
permission and ap ops checks in the downloads provider will
be verified against the caller of the media provider instead
of against the media provider itself.

bug:22629557

Change-Id: I444a2db96353f50c60cd1d7bb20538ab7d463a1e

src/com/android/providers/media/MediaProvider.java

@@ -3784,7 +3784,6 @@ public class MediaProvider extends ContentProvider {
         }
     }
 
-
     private MediaThumbRequest requestMediaThumbnail(String path, Uri uri, int priority, long magic) {
         synchronized (mMediaThumbQueue) {
             MediaThumbRequest req = null;
@@ -4992,6 +4991,8 @@ public class MediaProvider extends ContentProvider {
     private void writeAlbumArt(
             boolean need_to_recompress, Uri out, byte[] compressed, Bitmap bm) throws IOException {
         OutputStream outstream = null;
+        // Clear calling identity as we may be handling an IPC.
+        final long identity = Binder.clearCallingIdentity();
         try {
             outstream = getContext().getContentResolver().openOutputStream(out);
 
@@ -5005,6 +5006,7 @@ public class MediaProvider extends ContentProvider {
                 }
             }
         } finally {
+            Binder.restoreCallingIdentity(identity);
             IoUtils.closeQuietly(outstream);
         }
     }
@@ -5110,7 +5112,15 @@ public class MediaProvider extends ContentProvider {
                     // Note that this only does something if getAlbumArtOutputUri() reused an
                     // existing entry from the database. If a new entry was created, it will
                     // have been rolled back as part of backing out the transaction.
-                    getContext().getContentResolver().delete(out, null, null);
+
+                    // Clear calling identity as we may be handling an IPC.
+                    final long identity = Binder.clearCallingIdentity();
+                    try {
+                        getContext().getContentResolver().delete(out, null, null);
+                    } finally {
+                        Binder.restoreCallingIdentity(identity);
+                    }
+
                 }
             }
         }

src/com/android/providers/media/MediaThumbRequest.java

@@ -147,6 +147,8 @@ class MediaThumbRequest {
             if (fileMagic == magic) {
                 Cursor c = null;
                 ParcelFileDescriptor pfd = null;
+                // Clear calling identity as we may be handling an IPC.
+                final long identity = Binder.clearCallingIdentity();
                 try {
                     c = mCr.query(mThumbUri, THUMB_PROJECTION,
                             mOrigColumnName + " = " + mOrigId, null, null);
@@ -157,6 +159,7 @@ class MediaThumbRequest {
                 } catch (IOException ex) {
                     // MINI_THUMBNAIL not exists, ignore the exception and generate one.
                 } finally {
+                    Binder.restoreCallingIdentity(identity);
                     if (c != null) c.close();
                     if (pfd != null) {
                         pfd.close();