WifiStateMachine: Always return a copy of WifiInfo

WifiStateMachine#syncRequestConnectionInfo() should always return a copy
of WifiInfo to prevent external services directly accessing a local
variable in WifiStateMachine.  Binder calls within the same process
doesn't parcel objects, hence this is needed to prevent other threads in
system_server directly using a local object within the wifi service.

Bug: 64207440
Test: Unit test that checks for object returned from
WifiStateMachine#getWifiInfo() vs
WifiStateMachine#syncRequestConnectionInfo().

Change-Id: I3d709a09d3d10a1d133fd79eeee430830eb008b2

1 files changed, 2 insertions, 2 deletions

diff --git a/service/java/com/android/server/wifi/WifiStateMachine.java b/service/java/com/android/server/wifi/WifiStateMachine.java
index efea94b78..5f970026f 100644
--- a/service/java/com/android/server/wifi/WifiStateMachine.java
+++ b/service/java/com/android/server/wifi/WifiStateMachine.java
@@ -1758,9 +1758,9 @@ public class WifiStateMachine extends StateMachine implements WifiNative.WifiRss
      */
     public WifiInfo syncRequestConnectionInfo() {
         int uid = Binder.getCallingUid();
-        if (uid == Process.myUid()) return mWifiInfo;
-        boolean hideBssidAndSsid = true;
         WifiInfo result = new WifiInfo(mWifiInfo);
+        if (uid == Process.myUid()) return result;
+        boolean hideBssidAndSsid = true;
         result.setMacAddress(WifiInfo.DEFAULT_MAC_ADDRESS);
 
         IPackageManager packageManager = AppGlobals.getPackageManager();