Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77aa1529 authored by John Reck's avatar John Reck
Browse files

Fix use-after-free 

Change-Id: I8ac1ede5b29f718aa145e18cf1cc057722b62f2b
Fixes: 62810849
Test: Builds
(cherry picked from commit 3c1820e0)
parent 392ac74f

services/core/jni/com_android_server_GraphicsStatsService.cpp

+2 −1
Original line number Diff line number Diff line
@@ -43,8 +43,9 @@ static void addToDump(JNIEnv* env, jobject, jlong dumpPtr, jstring jpath, jstrin 
    std::string path;

    const ProfileData* data = nullptr;

    LOG_ALWAYS_FATAL_IF(jdata == nullptr && jpath == nullptr, "Path and data can't both be null");

    ScopedByteArrayRO buffer{env};

    if (jdata != nullptr) {

        ScopedByteArrayRO buffer(env, jdata);

        buffer.reset(jdata);

        LOG_ALWAYS_FATAL_IF(buffer.size() != sizeof(ProfileData),

                "Buffer size %zu doesn't match expected %zu!", buffer.size(), sizeof(ProfileData));

        data = reinterpret_cast<const ProfileData*>(buffer.get());