Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 13a734dc authored by Peter Collingbourne's avatar Peter Collingbourne
Browse files

Fix a use-after-free found by HWAsan. 

The variable sizeResult is an iterator pointing into mCurrentValues,
and clearing mCurrentValues invalidates the iterator.

Bug: 119773465
Change-Id: I940ea397af87561d33f74a9d52abc3afd0a7538f
parent 932f96b2

libs/hwui/pipeline/skia/SkiaMemoryTracer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -106,8 +106,9 @@ void SkiaMemoryTracer::processElement() { 
                resourceValues.insert({key, sizeResult->second});

            }

        } else {

            TraceValue sizeValue = sizeResult->second;

            mCurrentValues.clear();

            mCurrentValues.insert({key, sizeResult->second});

            mCurrentValues.insert({key, sizeValue});

            mResults.insert({resourceName, mCurrentValues});

        }

    }