Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f4e8eac authored by Weiyin Jiang's avatar Weiyin Jiang Committed by Gerrit - the friendly Code Review server
Browse files

post_proc: release vol listener object based on context 

Releasing volume listener object based on session_id and stream type is
not accurate, which results into false free and dangling pointer.

Change-Id: I23d54b81c0a4cbad2731d86a52beae54f3e05088
CRs-Fixed: 2399130
parent 4afc524c

post_proc/volume_listener.c

+1 −18
Original line number Diff line number Diff line
@@ -805,9 +805,6 @@ static int vol_prc_lib_release(effect_handle_t handle) 
    int status = -EINVAL;

    bool recompute_flag = false;

    int active_stream_count = 0;

    uint32_t session_id;

    uint32_t stream_type;

    effect_uuid_t uuid;



    ALOGV("%s context %p", __func__, handle);
@@ -815,26 +812,12 @@ static int vol_prc_lib_release(effect_handle_t handle) 
        return status;

    }

    pthread_mutex_lock(&vol_listner_init_lock);

    session_id = recv_contex->session_id;

    stream_type = recv_contex->stream_type;



    if (recv_contex->desc == NULL) {

        ALOGE("%s: Got NULL descriptor, session %u, stream type %u",

                __func__, session_id, stream_type);

        dump_list_l();

        pthread_mutex_unlock(&vol_listner_init_lock);

        return status;

    }

    uuid = recv_contex->desc->uuid;



    // check if the handle/context provided is valid

    list_for_each_safe(node, temp_node_next, &vol_effect_list) {

        context = node_to_item(node, struct vol_listener_context_s, effect_list_node);

        if ((memcmp(&(context->desc->uuid), &uuid, sizeof(effect_uuid_t)) == 0)

            && (context->session_id == session_id)

            && (context->stream_type == stream_type)) {

        if (context == recv_contex) {

            ALOGV("--- Found something to remove ---");

            list_remove(node);

            PRINT_STREAM_TYPE(context->stream_type);

            if (verify_context(context)) {

                recompute_flag = true;