Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e3a5687 authored by gaoxiupei's avatar gaoxiupei
Browse files

PatchTrackBase: fix null pointer dereference issue 



cblk will be released when the function isTrackAllowed_l returns false, so when creating PatchTrackBase we should check whether the cblk is released to prevent null pointer dereferencing issue.

Test: make libaudioflinger
Bug: 290325983

Change-Id: I2a61b5b4f7777528cd4f8f2aa80dfec113bfce2e
Signed-off-by: default avatargaoxiupei <gaoxiupei@xiaomi.corp-partner.google.com>
parent 46a894dc

services/audioflinger/Tracks.cpp

+4 −2
Original line number Diff line number Diff line
@@ -2186,7 +2186,8 @@ AudioFlinger::PlaybackThread::PatchTrack::PatchTrack(PlaybackThread *playbackThr 
              buffer, bufferSize, nullptr /* sharedBuffer */,

              AUDIO_SESSION_NONE, getpid(), audioServerAttributionSource(getpid()), flags,

              TYPE_PATCH, AUDIO_PORT_HANDLE_NONE, frameCountToBeReady),

        PatchTrackBase(new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, true, true),

        PatchTrackBase(mCblk ? new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, true, true)

                        : nullptr,

                       *playbackThread, timeout)

{

    ALOGV("%s(%d): sampleRate %d mPeerTimeout %d.%03d sec",
@@ -2766,7 +2767,8 @@ AudioFlinger::RecordThread::PatchRecord::PatchRecord(RecordThread *recordThread, 
                sampleRate, format, channelMask, frameCount,

                buffer, bufferSize, AUDIO_SESSION_NONE, getpid(),

                audioServerAttributionSource(getpid()), flags, TYPE_PATCH),

        PatchTrackBase(new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, false, true),

        PatchTrackBase(mCblk ? new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, false, true)

                        : nullptr,

                       *recordThread, timeout)

{

    ALOGV("%s(%d): sampleRate %d mPeerTimeout %d.%03d sec",