Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fca81256 authored by Christer Fletcher's avatar Christer Fletcher Committed by Takeshi Aimi
Browse files

Set u.ext_data to null after it has been freed 

SEGV_MAPPER crash could happen in MetaData::typed_data::freeStorage.
The faulty address could be both random pointers and deadbaad. It
seems like free could be called more than once on u.ext_data. Set
u.ext_data to null after it has been freed as there already is a
null check before trying to free it.

Change-Id: I710c49f9c231bd8852159914c0b2add58a685f0e
parent d74a9ee8

media/libstagefright/MetaData.cpp

+1 −0
Original line number Diff line number Diff line
@@ -282,6 +282,7 @@ void MetaData::typed_data::freeStorage() { 
    if (!usesReservoir()) {

        if (u.ext_data) {

            free(u.ext_data);

            u.ext_data = NULL;

        }

    }