libstagefright: Fix heap corruption from AudioSource
AudioSource allocates memory for member variable mTempBuf in its constructor and deallocates during reset, but mTempBuf can be dereferenced on event EVENT_NEW_POS even after reset, since AudioRecord instance can post this event while exiting threadloop even after stop is called on AudioRecord. Also reset is called from destructor only if mStarted is true, which means the memory can miss deallocation if start is not called before AudioSource instance is destroyed. Moving deallocation of mTempBuf to destructor will solve both the issues. Change-Id: Ie42f0894e6b3e7c7ea734814ab90d46ee2d7c753
Loading
Please register or sign in to comment