Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 709ad419 authored by Wonsik Kim's avatar Wonsik Kim
Browse files

aacdec: fix memory leak at onStop() 

onStop() may invoke initDecoder() which could reallocate output ring
buffer without releasing the existing one.

Bug: 196484690
Test: cts/media/device-small
Change-Id: I245aaf2a3c2d471e02befbd67fbe30e54ac8967a
parent 54728279

media/codec2/components/aac/C2SoftAacDec.cpp

+3 −5
Original line number Diff line number Diff line
@@ -287,6 +287,7 @@ c2_status_t C2SoftAacDec::onStop() { 
    mOutputDelayRingBufferWritePos = 0;

    mOutputDelayRingBufferReadPos = 0;

    mOutputDelayRingBufferFilled = 0;

    mOutputDelayRingBuffer.reset();

    mBuffersInfo.clear();



    status_t status = UNKNOWN_ERROR;
@@ -308,10 +309,7 @@ void C2SoftAacDec::onRelease() { 
        aacDecoder_Close(mAACDecoder);

        mAACDecoder = nullptr;

    }

    if (mOutputDelayRingBuffer) {

        delete[] mOutputDelayRingBuffer;

        mOutputDelayRingBuffer = nullptr;

    }

    mOutputDelayRingBuffer.reset();

}



status_t C2SoftAacDec::initDecoder() {
@@ -327,7 +325,7 @@ status_t C2SoftAacDec::initDecoder() { 


    mOutputDelayCompensated = 0;

    mOutputDelayRingBufferSize = 2048 * MAX_CHANNEL_COUNT * kNumDelayBlocksMax;

    mOutputDelayRingBuffer = new short[mOutputDelayRingBufferSize];

    mOutputDelayRingBuffer.reset(new short[mOutputDelayRingBufferSize]);

    mOutputDelayRingBufferWritePos = 0;

    mOutputDelayRingBufferReadPos = 0;

    mOutputDelayRingBufferFilled = 0;

media/codec2/components/aac/C2SoftAacDec.h

+1 −1
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ private: 
    bool mEndOfOutput;

    int32_t mOutputDelayCompensated;

    int32_t mOutputDelayRingBufferSize;

    short *mOutputDelayRingBuffer;

    std::unique_ptr<short[]> mOutputDelayRingBuffer;

    int32_t mOutputDelayRingBufferWritePos;

    int32_t mOutputDelayRingBufferReadPos;

    int32_t mOutputDelayRingBufferFilled;