Camera: Fix use-after-free in AidlProviderInfo
Passing a RefBase object as a cookie for linkToDeath is problematic because RefBase is reference counted, and it may be deleted while the raw pointer is held. Instead, create a struct containing a weak pointer to the object. This way we decouple the life cycle of the AidlProviderInfo from the death notification cookie. Flag: EXEMPT bug-fix Test: Vendor testing, run camera and kill provider, Camera CTS Bug: 381496144 Change-Id: I477e121a77a7a2501e4ae9f86ce513355f98847a
Loading
Please register or sign in to comment