Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8cbbf9f authored by Pawin Vongmasa's avatar Pawin Vongmasa
Browse files

Fix null pointer dereferencing in TWGBP 

Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 64227158
Bug: 64495583
Change-Id: I3bcab37346d5d7de31a7c24b2951b3501fa9858f
parent 92f48fc7

media/libstagefright/omx/1.0/WGraphicBufferProducer.cpp

+3 −1
Original line number Original line Diff line number Diff line
@@ -41,7 +41,9 @@ Return<void> TWGraphicBufferProducer::requestBuffer( 
    sp<GraphicBuffer> buf;

    sp<GraphicBuffer> buf;

    status_t status = mBase->requestBuffer(slot, &buf);

    status_t status = mBase->requestBuffer(slot, &buf);

    AnwBuffer anwBuffer;

    AnwBuffer anwBuffer;

    if (buf != nullptr) {

        wrapAs(&anwBuffer, *buf);

        wrapAs(&anwBuffer, *buf);

    }

    _hidl_cb(static_cast<int32_t>(status), anwBuffer);

    _hidl_cb(static_cast<int32_t>(status), anwBuffer);

    return Void();

    return Void();

}

}

media/libstagefright/omx/include/media/stagefright/omx/1.0/Conversion.h

+4 −2
Original line number Original line Diff line number Diff line
@@ -2064,8 +2064,10 @@ inline bool convertTo( 
    int const* constFds = static_cast<int const*>(baseFds.get());

    int const* constFds = static_cast<int const*>(baseFds.get());

    numFds = baseNumFds;

    numFds = baseNumFds;

    if (l->unflatten(constBuffer, size, constFds, numFds) != NO_ERROR) {

    if (l->unflatten(constBuffer, size, constFds, numFds) != NO_ERROR) {

        if (nh != nullptr) {

            native_handle_close(nh);

            native_handle_close(nh);

            native_handle_delete(nh);

            native_handle_delete(nh);

        }

        return false;

        return false;

    }

    }