Merge "Limit size of initial Parcel for async binder call" (2503bf24) · Commits · e / os / android_frameworks_base

media/java/android/service/media/MediaBrowserService.java

+9 −2

Original line number	Diff line number	Diff line
		@@ -684,8 +684,15 @@ public abstract class MediaBrowserService extends Service {
		List<MediaBrowser.MediaItem> filteredList =
		(flag & RESULT_FLAG_OPTION_NOT_HANDLED) != 0
		? applyOptions(list, options) : list;
		final ParceledListSlice<MediaBrowser.MediaItem> pls =
		filteredList == null ? null : new ParceledListSlice<>(filteredList);
		final ParceledListSlice<MediaBrowser.MediaItem> pls;
		if (filteredList == null) {
		pls = null;
		} else {
		pls = new ParceledListSlice<>(filteredList);
		// Limit the size of initial Parcel to prevent binder buffer overflow
		// as onLoadChildren is an async binder call.
		pls.setInlineCountLimit(1);
		}
		try {
		connection.callbacks.onLoadChildren(parentId, pls, options);
		} catch (RemoteException ex) {

+10 −2

Original line number	Diff line number	Diff line
		@@ -589,11 +589,19 @@ public class MediaSessionRecord implements IBinder.DeathRecipient, MediaSessionR
		if (mDestroyed) {
		return;
		}
		ParceledListSlice<QueueItem> parcelableQueue;
		if (mQueue == null) {
		parcelableQueue = null;
		} else {
		parcelableQueue = new ParceledListSlice<>(mQueue);
		// Limit the size of initial Parcel to prevent binder buffer overflow
		// as onQueueChanged is an async binder call.
		parcelableQueue.setInlineCountLimit(1);
		}
		for (int i = mControllerCallbackHolders.size() - 1; i >= 0; i--) {
		ISessionControllerCallbackHolder holder = mControllerCallbackHolders.get(i);
		try {
		holder.mCallback.onQueueChanged(mQueue == null ? null :
		new ParceledListSlice<>(mQueue));
		holder.mCallback.onQueueChanged(parcelableQueue);
		} catch (DeadObjectException e) {
		mControllerCallbackHolders.remove(i);
		logCallbackException("Removing dead callback in pushQueueUpdate", holder, e);