Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e82b8d9 authored by Alec Mouri's avatar Alec Mouri
Browse files

[RenderEngine] Fix use-after-move error 

GLESREnderEngine::waitFence takes ownership of the file descriptor, so
callers must dup it first. Otherwise, this results in a use-after-free
error on devices that do not support EGL_ANDROID_native_fence_sync.

Bug: 150954608
Test: WITH_TIDY=1 m -j
Change-Id: I7e6d88c0f282a317fd8e603dccb918f3d5bc0fcc
parent 1c7bc86a

libs/renderengine/gl/GLESRenderEngine.cpp

+7 −3
Original line number Diff line number Diff line
@@ -973,10 +973,14 @@ status_t GLESRenderEngine::drawLayers(const DisplaySettings& display, 
        return NO_ERROR;

    }



    if (bufferFence.get() >= 0 && !waitFence(std::move(bufferFence))) {

    if (bufferFence.get() >= 0) {

        // Duplicate the fence for passing to waitFence.

        base::unique_fd bufferFenceDup(dup(bufferFence.get()));

        if (bufferFenceDup < 0 || !waitFence(std::move(bufferFenceDup))) {

            ATRACE_NAME("Waiting before draw");

            sync_wait(bufferFence.get(), -1);

        }

    }



    if (buffer == nullptr) {

        ALOGE("No output buffer provided. Aborting GPU composition.");