Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 751c7c94 authored by Wenjie Zhou's avatar Wenjie Zhou
Browse files

mCallback defined in BringYourOwnSection should be an object instead of a reference. 

The referenced object could be destroyed and result in native crash when
mCallback is used.

Bug: 156536687
Test: manual test with registering a section from an app
Change-Id: Ie36c0e6e64be1246539f12999f037c24377686dd
parent d8345749

cmds/incidentd/src/IncidentService.cpp

+4 −4
Original line number Diff line number Diff line
@@ -351,9 +351,9 @@ Status IncidentService::reportIncidentToDumpstate(unique_fd stream, 


Status IncidentService::registerSection(const int id, const String16& name16,

        const sp<IIncidentDumpCallback>& callback) {

    const char* name = String8(name16).c_str();

    const String8 name = String8(name16);

    const uid_t callingUid = IPCThreadState::self()->getCallingUid();

    ALOGI("Uid %d registers section %d '%s'", callingUid, id, name);

    ALOGI("Uid %d registers section %d '%s'", callingUid, id, name.c_str());

    if (callback == nullptr) {

        return Status::fromExceptionCode(Status::EX_NULL_POINTER);

    }
@@ -363,11 +363,11 @@ Status IncidentService::registerSection(const int id, const String16& name16, 
                ALOGW("Error registering section %d: calling uid does not match", id);

                return Status::fromExceptionCode(Status::EX_SECURITY);

            }

            mRegisteredSections.at(i) = new BringYourOwnSection(id, name, callingUid, callback);

            mRegisteredSections.at(i) = new BringYourOwnSection(id, name.c_str(), callingUid, callback);

            return Status::ok();

        }

    }

    mRegisteredSections.push_back(new BringYourOwnSection(id, name, callingUid, callback));

    mRegisteredSections.push_back(new BringYourOwnSection(id, name.c_str(), callingUid, callback));

    return Status::ok();

}

cmds/incidentd/src/Section.cpp

+3 −1
Original line number Diff line number Diff line
@@ -876,7 +876,9 @@ BringYourOwnSection::~BringYourOwnSection() {} 


status_t BringYourOwnSection::BlockingCall(unique_fd& pipeWriteFd) const {

    android::os::ParcelFileDescriptor pfd(std::move(pipeWriteFd));

    if(mCallback != nullptr) {

        mCallback->onDumpSection(pfd);

    }

    return NO_ERROR;

}

cmds/incidentd/src/Section.h

+1 −1
Original line number Diff line number Diff line
@@ -207,7 +207,7 @@ public: 
    virtual status_t BlockingCall(unique_fd& pipeWriteFd) const;



private:

    const sp<IIncidentDumpCallback>& mCallback;

    const sp<IIncidentDumpCallback> mCallback;

};

core/java/android/os/IIncidentDumpCallback.aidl

+2 −1
Original line number Diff line number Diff line
@@ -25,7 +25,8 @@ import android.os.ParcelFileDescriptor; 
 */

oneway interface IIncidentDumpCallback {

    /**

     * Dumps section data to the given ParcelFileDescriptor.

     * Dumps section data to the given ParcelFileDescriptor, which needs to be

     * closed properly after writing the data.

     */

    void onDumpSection(in ParcelFileDescriptor fd);

}