Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit f3ef6fd8 authored by Shuzhen Wang's avatar Shuzhen Wang
Browse files

Camera: Fix use-after-free in AidlProviderInfo

Passing a RefBase object as a cookie for linkToDeath is problematic
because RefBase is reference counted, and it may be deleted while the
raw pointer is held.

Instead, create a struct containing a weak pointer to the object. This
way we decouple the life cycle of the AidlProviderInfo from the death
notification cookie.

Flag: EXEMPT bug-fix
Test: Vendor testing, run camera and kill provider, Camera CTS
Bug: 381496144
Change-Id: I477e121a77a7a2501e4ae9f86ce513355f98847a
parent 9aab1380
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment