Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b35141c6 authored by Henry Fang's avatar Henry Fang
Browse files

Fix use after free issue 

inside removeResource, it free this (DeathNotifier object)
overridePid after removeResource will cause use-after-free issue

bug: 152324474
Test: Manual
Change-Id: I353a3e6812dd3c0b4989aa7fdb28b17f83fb0816
parent 529e9da2

services/mediaresourcemanager/ResourceManagerService.cpp

+3 −1
Original line number Diff line number Diff line
@@ -57,9 +57,11 @@ void DeathNotifier::binderDied() { 
        ALOGW("ResourceManagerService is dead as well.");

        return;

    }

    service->removeResource(mPid, mClientId, false);



    service->overridePid(mPid, -1);

    // thiz is freed in the call below, so it must be last call referring thiz

    service->removeResource(mPid, mClientId, false);



}



template <typename T>