Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6aaef5a9 authored by Andrew Lewis's avatar Andrew Lewis Committed by Ray Essick
Browse files

Fix potential use-after-free issue 

NuPlayerListener passed this out of its constructor to
IStreamSource->setListener, and it would get wrapped in a smart pointer,
then free'd when that method returned.

Move the setListener call after instantiation of NuPlayerListener to
avoid passing this out of the NuPlayerListener constructor.

Test: tested in presubmit
Bug: 151456667
Change-Id: I996d9ad9eaf0e52992b7f9e10fd94a94c350ad73
(cherry picked from commit aad519df)
parent 5d8def9a

media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp

+0 −2
Original line number Diff line number Diff line
@@ -34,8 +34,6 @@ NuPlayer::NuPlayerStreamListener::NuPlayerStreamListener( 
      mTargetHandler(targetHandler),

      mEOS(false),

      mSendDataNotification(true) {

    mSource->setListener(this);



    mMemoryDealer = new MemoryDealer(kNumBuffers * kBufferSize);

    for (size_t i = 0; i < kNumBuffers; ++i) {

        sp<IMemory> mem = mMemoryDealer->allocate(kBufferSize);

media/libmediaplayerservice/nuplayer/StreamingSource.cpp

+1 −0
Original line number Diff line number Diff line
@@ -83,6 +83,7 @@ void NuPlayer::StreamingSource::prepareAsync() { 


void NuPlayer::StreamingSource::start() {

    mStreamListener = new NuPlayerStreamListener(mSource, NULL);

    mSource->setListener(mStreamListener);



    uint32_t sourceFlags = mSource->flags();