Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61c3fcf7 authored by Steven Moreland's avatar Steven Moreland
Browse files

libhwui: AnimatedImageThread - UAF 

Fix branch subject to UAF.

Bug: 186468053
Test: atest android.graphics.drawable.cts.AnimatedImageDrawableTest
    (w/ UAF detection enabled in libutils Thread)
Change-Id: Idb45f5ef41436920d0ce00f609fa25fb8fdccddf
parent d56cd5e5

libs/hwui/hwui/AnimatedImageThread.cpp

+6 −3
Original line number Diff line number Diff line
@@ -22,13 +22,16 @@ namespace android { 
namespace uirenderer {



AnimatedImageThread& AnimatedImageThread::getInstance() {

    static AnimatedImageThread* sInstance = new AnimatedImageThread();

    return *sInstance;

    [[clang::no_destroy]] static sp<AnimatedImageThread> sInstance = []() {

        sp<AnimatedImageThread> thread = sp<AnimatedImageThread>::make();

        thread->start("AnimatedImageThread");

        return thread;

    }();

    return *sInstance.get();

}



AnimatedImageThread::AnimatedImageThread() {

    setpriority(PRIO_PROCESS, 0, PRIORITY_NORMAL + PRIORITY_MORE_FAVORABLE);

    start("AnimatedImageThread");

}



std::future<AnimatedImageDrawable::Snapshot> AnimatedImageThread::decodeNextFrame(

libs/hwui/hwui/AnimatedImageThread.h

+1 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ public: 
    std::future<AnimatedImageDrawable::Snapshot> reset(const sk_sp<AnimatedImageDrawable>&);



private:

    friend sp<AnimatedImageThread>;

    AnimatedImageThread();

};