Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2531d69c authored by Chong Zhang's avatar Chong Zhang
Browse files

muxer: set observer before we start waiting for read 

If nobody ever reads the buffer before stop is called,
MediaAdapter will go ahead and release mCurrentMediaBuffer.
If it doesn't have an observer set, it will crash as it
does have a refcount of 1.

This can happen when the writer thread encountered an
error and calls stop early, in this case it will never
read the pending buffer.

bug: 70348810

Test:

- CTS MediaRecorderTest, MediaMuxerTest
- Hacked framework to produce a similar crash as in
  b/70348810 and verified no crash in stagefright.

Change-Id: Ia2017e6a13fca279c9603afe53ab6013b9c669f5
parent 0ebfd1e1

media/libstagefright/MediaAdapter.cpp

+17 −10
Original line number Diff line number Diff line
@@ -45,18 +45,25 @@ status_t MediaAdapter::start(MetaData * /* params */) { 
}



status_t MediaAdapter::stop() {

    MediaBuffer *currentBuffer = NULL;

    {

        Mutex::Autolock autoLock(mAdapterLock);

        if (mStarted) {

            mStarted = false;

            // If stop() happens immediately after a pushBuffer(), we should

        // clean up the mCurrentMediaBuffer

        if (mCurrentMediaBuffer != NULL) {

            mCurrentMediaBuffer->release();

            // clean up the mCurrentMediaBuffer. But need to release without

            // the lock as signalBufferReturned() will acquire the lock.

            currentBuffer = mCurrentMediaBuffer;

            mCurrentMediaBuffer = NULL;

        }



            // While read() is still waiting, we should signal it to finish.

            mBufferReadCond.signal();

        }

    }

    if (currentBuffer != NULL) {

        currentBuffer->release();

        currentBuffer = NULL;

    }

    return OK;

}
@@ -97,7 +104,6 @@ status_t MediaAdapter::read( 


    *buffer = mCurrentMediaBuffer;

    mCurrentMediaBuffer = NULL;

    (*buffer)->setObserver(this);



    return OK;

}
@@ -114,6 +120,7 @@ status_t MediaAdapter::pushBuffer(MediaBuffer *buffer) { 
        return INVALID_OPERATION;

    }

    mCurrentMediaBuffer = buffer;

    mCurrentMediaBuffer->setObserver(this);

    mBufferReadCond.signal();



    ALOGV("wait for the buffer returned @ pushBuffer! %p", buffer);