Merge "Fix heap-use-after-free issue flagged by fuzzer test." into rvc-dev (9e02a6e3) · Commits · e / os / android_frameworks_av

media/mtp/MtpFfsHandle.cpp

+14 −0

Original line number	Diff line number	Diff line
		@@ -296,6 +296,10 @@ int MtpFfsHandle::start(bool ptp) {
		}

		void MtpFfsHandle::close() {
		auto timeout = std::chrono::seconds(2);
		std::unique_lock lk(m);
		cv.wait_for(lk, timeout ,[this]{return child_threads==0;});

		io_destroy(mCtx);
		closeEndpoints();
		closeConfig();
		@@ -662,6 +666,11 @@ int MtpFfsHandle::sendEvent(mtp_event me) {
		char *temp = new char[me.length];
		memcpy(temp, me.data, me.length);
		me.data = temp;

		std::unique_lock lk(m);
		child_threads++;
		lk.unlock();

		std::thread t([this, me]() { return this->doSendEvent(me); });
		t.detach();
		return 0;
		@@ -673,6 +682,11 @@ void MtpFfsHandle::doSendEvent(mtp_event me) {
		if (static_cast<unsigned>(ret) != length)
		PLOG(ERROR) << "Mtp error sending event thread!";
		delete[] reinterpret_cast<char*>(me.data);

		std::unique_lock lk(m);
		child_threads--;
		lk.unlock();
		cv.notify_one();
		}

		} // namespace android

+4 −0

Original line number	Diff line number	Diff line
		@@ -58,6 +58,10 @@ protected:

		bool mCanceled;

		std::mutex m;
		std::condition_variable cv;
		std::atomic<int> child_threads{0};

		android::base::unique_fd mControl;
		// "in" from the host's perspective => sink for mtp server
		android::base::unique_fd mBulkIn;