Merge pull request juliansteenbakker#1209 from sanjay-aaritya/fix/android-catch-throwable-worker-thread

fix(android): catch Throwable on worker thread so keystore Errors don't crash the app

Author: juliansteenbakker

flutter_secure_storage/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Unreleased
+
+### Android
+
+- Fixed a fatal app crash when Android Keystore framework code throws `java.lang.Error` subclasses (e.g. `NoSuchFieldError` on some OEM builds with mismatched framework/KeyMint classes): the plugin's worker thread now catches `Throwable` and reports a `PlatformException` to Dart instead of killing the process.
+
 ## 11.0.0-beta.1
 
 **Breaking changes**

flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/FlutterSecureStorage.java

@@ -188,9 +188,13 @@ public void onSuccess(BiometricPrompt.AuthenticationResult result) {
                     try {
                         storageCipher = storageCipherFactory.getCurrentStorageCipher(context, result.getCryptoObject().getCipher());
                         Log.d(TAG, "Biometric authentication succeeded");
-                    } catch (Exception e) {
+                    } catch (Throwable e) {
+                        if (e instanceof VirtualMachineError) {
+                            throw (VirtualMachineError) e;
+                        }
                         Log.e(TAG, "Failed to initialize storage cipher after authentication", e);
-                        callback.onError(e);
+                        callback.onError(new Exception(e));
+                        return;
                     }
                     callback.onSuccess(null);
                 }

flutter_secure_storage/android/src/main/java/com/it_nomads/fluttersecurestorage/FlutterSecureStoragePlugin.java

@@ -230,12 +230,15 @@ public void onSuccess(Void unused) {
                                 result.notImplemented();
                                 break;
                         }
-                    } catch (Exception e) {
+                    } catch (Throwable e) {
+                        if (e instanceof VirtualMachineError) {
+                            throw (VirtualMachineError) e;
+                        }
                         if (config.shouldDeleteOnFailure()) {
                             try {
                                 secureStorage.deleteAll();
                                 result.success("Data has been reset");
-                            } catch (Exception ex) {
+                            } catch (Throwable ex) {
                                 handleException(ex);
                             }
                         } else {
@@ -249,13 +252,23 @@ public void onError(Exception e) {
                     handleException(e);
                 }
             });
-            } catch (Exception e) {
+            } catch (Throwable e) {
+                // Catch Throwable, not just Exception: some OEM builds throw
+                // java.lang.Error subclasses (e.g. NoSuchFieldError) from Android
+                // Keystore framework code, and an uncaught Error on this
+                // HandlerThread would crash the entire app process. Genuine VM
+                // errors (OOM, StackOverflow) are rethrown instead of being
+                // funneled through handleException/deleteAll, which would
+                // allocate memory the JVM may no longer have.
+                if (e instanceof VirtualMachineError) {
+                    throw (VirtualMachineError) e;
+                }
                 handleException(e);
             }
         }
 
 
-        private void handleException(Exception e) {
+        private void handleException(Throwable e) {
             StringWriter stringWriter = new StringWriter();
             e.printStackTrace(new PrintWriter(stringWriter));
             // Send exception message as the message field so Flutter can parse it