Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66394b8c authored by Avichal Rakesh's avatar Avichal Rakesh
Browse files

Lock buffer before printing package name 

String8's buffer is not when calling String8.string() function,
and can change if the reference returned by String8.string is kept past
one access. Repeated reads to the reference returned by String8.string()
can lead to garbage values.

This CL locks the buffer of a packageName's String8 object before using
it for printing.

Bug: 199746421
Test: Manually Tested
Change-Id: Ib237f078f2b4b9254208477a56db7a2921d72185
parent 3a85d2dd

services/camera/libcameraservice/CameraService.cpp

+6 −2
Original line number Diff line number Diff line
@@ -4949,13 +4949,17 @@ void CameraService::printNewWatchedEvents(int outFd, 


    if (lastPrintedIdx == 0) { return; } // early exit if no new event in `events`



    const char *printPackageName = String8(packageName).string();

    String8 packageName8(packageName);

    const char * printablePackageName = packageName8.lockBuffer(packageName8.size());



    // print events in chronological order (latest event last)

    size_t idxToPrint = lastPrintedIdx;

    do {

        idxToPrint--;

        dprintf(outFd, "%s:%s  %s", cameraId, printPackageName, events[idxToPrint].c_str());

        dprintf(outFd, "%s:%s  %s", cameraId, printablePackageName, events[idxToPrint].c_str());

    } while (idxToPrint != 0);



    packageName8.unlockBuffer();

}



void CameraService::parseClientsToWatchLocked(String8 clients) {