Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26b3d1ff authored by Jean-Michel Trivi's avatar Jean-Michel Trivi
Browse files

Fix bug 5357295 NPE on display when remote control client dies 

When a IRemoteControlClient dies, that client is set to null
 in the stack of remote control entries (mRCStack). This is done
 by calling registerRemoteControlClient() with a null client.
The bug is that registerRemoteControlClient(), after storing
 the new client, uses it to let it know what the current
 remote control display is. When that display is non null, the
 client is sent the current display. So when a client died
 when there was a display, the client reference was accessed
 in the part of the method where we haven't yet checked whether
 it is null or not.
The fix consists in moving the setting of the display on the
 client (method plugRemoteControlDisplay) only after having
 checked that the client is non-null.

Change-Id: Ic74d6cba9e3a3a16e78cd80a1ae5901abfeb3905
parent 2b2adbdd

media/java/android/media/AudioService.java

+18 −10
Original line number Diff line number Diff line
@@ -2958,7 +2958,7 @@ public class AudioService extends IAudioService.Stub { 
            Log.w(TAG, "  RemoteControlClient died");

            // remote control client died, make sure the displays don't use it anymore

            //  by setting its remote control client to null

            registerRemoteControlClient(mMediaIntent, null, null/*ignored*/);

            registerRemoteControlClient(mMediaIntent, null/*rcClient*/, null/*ignored*/);

        }



        public IBinder getBinder() {
@@ -3366,7 +3366,12 @@ public class AudioService extends IAudioService.Stub { 
        }

    }



    /** see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...) */

    /**

     * see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...)

     * Note: using this method with rcClient == null is a way to "disable" the IRemoteControlClient

     *     without modifying the RC stack, but while still causing the display to refresh (will

     *     become blank as a result of this)

     */

    public void registerRemoteControlClient(PendingIntent mediaIntent,

            IRemoteControlClient rcClient, String callingPackageName) {

        if (DEBUG_RC) Log.i(TAG, "Register remote control client rcClient="+rcClient);
@@ -3384,6 +3389,15 @@ public class AudioService extends IAudioService.Stub { 
                        }

                        // save the new remote control client

                        rcse.mRcClient = rcClient;

                        rcse.mCallingPackageName = callingPackageName;

                        rcse.mCallingUid = Binder.getCallingUid();

                        if (rcClient == null) {

                            rcse.mRcClientDeathHandler = null;

                            break;

                        }



                        // there is a new (non-null) client:

                        // 1/ give the new client the current display (if any)

                        if (mRcDisplay != null) {

                            try {

                                rcse.mRcClient.plugRemoteControlDisplay(mRcDisplay);
@@ -3392,14 +3406,8 @@ public class AudioService extends IAudioService.Stub { 
                                e.printStackTrace();

                            }

                        }

                        rcse.mCallingPackageName = callingPackageName;

                        rcse.mCallingUid = Binder.getCallingUid();

                        if (rcClient == null) {

                            rcse.mRcClientDeathHandler = null;

                            break;

                        }

                        // monitor the new client's death

                        IBinder b = rcClient.asBinder();

                        // 2/ monitor the new client's death

                        IBinder b = rcse.mRcClient.asBinder();

                        RcClientDeathHandler rcdh =

                                new RcClientDeathHandler(b, rcse.mMediaIntent);

                        try {