[SmartLock] Delay AuthAttempt destruction until screen unlocks.
Prior to this CL, the AuthAttempt managed by EasyUnlockService only remained alive from the point the user began Smart Lock auth flow (user profile photo is tapped) until EasyUnlockService received confirmation from the phone that unlock is allowed. If the user double-clicked that user profile photo, the second click would very likely occur after the phone approved the unlock request, which meant EasyUnlockService kicked off a whole new AuthAttempt while the screen was unlocking and Smart Lock was actually in the middle of tearing itself down. In particular, MessengerImpl was torn down and encountered a UAF. I suspect this crash was quite easy to encounter on the sign-in screen because it takes several seconds for the cryptohome to decrypt -- it's very likely that users could tap the user profile picture multiple times because it feels as if the sign-in screen is stuck. This CL only tears down the AuthAttempt in a successful flow once the screen unlocks (see UpdateScreenlockState()). This allows the check in EasyUnlockService::AttemptAuth() to actually prevent multiple auth attempt requests. Fixed: 974410, 1041446 Change-Id: Ia65fbd546a543523d9393c459ec602bcce2ed81f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2774284 Reviewed-by:James Vecore <vecore@google.com> Commit-Queue: Ryan Hansberry <hansberry@chromium.org> Cr-Commit-Position: refs/heads/master@{#864688}
Loading
Please register or sign in to comment