Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f86a004c authored by jiabin's avatar jiabin
Browse files

Free data queue before closing data file descriptor. 

When data file descriptor is closed, the raw pointer mapped from the
file descriptor is invalidated. In that case, the data queue should be
freed so that it won't access the invalid address.

Bug: 314872581
Test: manually
Change-Id: Ida375e14cc3f9d85d434e45e539c8cff3125f992
parent 8d7480e6

media/libaaudio/src/binding/AudioEndpointParcelable.h

+1 −1
Original line number Diff line number Diff line
@@ -53,7 +53,7 @@ public: 
    int32_t addFileDescriptor(const android::base::unique_fd& fd, int32_t sizeInBytes);



    /**

     * Close current data file descriptor. The duplicated file descriptor will be close.

     * Close current data file descriptor. The duplicated file descriptor will be closed.

     */

    void closeDataFileDescriptor();

media/libaaudio/src/client/AudioEndpoint.h

+1 −1
Original line number Diff line number Diff line
@@ -107,7 +107,7 @@ public: 
     */

    void eraseDataMemory();



    void freeDataQueue();

    void freeDataQueue() { mDataQueue.reset(); }



    void dump() const;

media/libaaudio/src/client/AudioStreamInternal.cpp

+6 −0
Original line number Diff line number Diff line
@@ -399,6 +399,12 @@ aaudio_result_t AudioStreamInternal::exitStandby_l() { 
    uint8_t buffer[getDeviceBufferCapacity() * getBytesPerFrame()];

    android::fifo_frames_t fullFramesAvailable = mAudioEndpoint->read(buffer,

            getDeviceBufferCapacity());

    // Before releasing the data queue, update the frames read and written.

    getFramesRead();

    getFramesWritten();

    // Call freeDataQueue() here because the following call to

    // closeDataFileDescriptor() will invalidate the pointers used by the data queue.

    mAudioEndpoint->freeDataQueue();

    mEndPointParcelable.closeDataFileDescriptor();

    aaudio_result_t result = mServiceInterface.exitStandby(

            mServiceStreamHandleInfo, endpointParcelable);

media/libaaudio/src/client/AudioStreamInternalCapture.cpp

+2 −1
Original line number Diff line number Diff line
@@ -273,7 +273,8 @@ int64_t AudioStreamInternalCapture::getFramesWritten() { 


int64_t AudioStreamInternalCapture::getFramesRead() {

    if (mAudioEndpoint) {

        mLastFramesRead = mAudioEndpoint->getDataReadCounter() + mFramesOffsetFromService;

        mLastFramesRead = std::max(mLastFramesRead,

                                   mAudioEndpoint->getDataReadCounter() + mFramesOffsetFromService);

    }

    return mLastFramesRead;

}

media/libaaudio/src/client/AudioStreamInternalPlay.cpp

+3 −2
Original line number Diff line number Diff line
@@ -329,8 +329,9 @@ int64_t AudioStreamInternalPlay::getFramesRead() { 


int64_t AudioStreamInternalPlay::getFramesWritten() {

    if (mAudioEndpoint) {

        mLastFramesWritten = mAudioEndpoint->getDataWriteCounter()

                             + mFramesOffsetFromService;

        mLastFramesWritten = std::max(

                mLastFramesWritten,

                mAudioEndpoint->getDataWriteCounter() + mFramesOffsetFromService);

    }

    return mLastFramesWritten;

}