Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82df2c08 authored by RoboErik's avatar RoboErik
Browse files

Ensure metadata bundles are unparceled before making them available 

Bundles can't be read from multiple threads safely. This adds locking
around a read that had been previously overlooked and ensures that
unparcel is called on the metadata before it is even available to
other threads.

bug:17894033
Change-Id: I9a4b86a0d0af05b1dcba28a52df2e7a87c685704
parent 78cc93ec

services/core/java/com/android/server/media/MediaSessionRecord.java

+11 −7
Original line number Diff line number Diff line
@@ -625,13 +625,13 @@ public class MediaSessionRecord implements IBinder.DeathRecipient { 


    private PlaybackState getStateWithUpdatedPosition() {

        PlaybackState state;

        long duration = -1;

        synchronized (mLock) {

            state = mPlaybackState;

        }

        long duration = -1;

            if (mMetadata != null && mMetadata.containsKey(MediaMetadata.METADATA_KEY_DURATION)) {

                duration = mMetadata.getLong(MediaMetadata.METADATA_KEY_DURATION);

            }

        }

        PlaybackState result = null;

        if (state != null) {

            if (state.getState() == PlaybackState.STATE_PLAYING
@@ -725,10 +725,14 @@ public class MediaSessionRecord implements IBinder.DeathRecipient { 


        @Override

        public void setMetadata(MediaMetadata metadata) {

            // Make a copy of the metadata as the underlying bundle may be

            // modified on this thread.

            synchronized (mLock) {

                mMetadata = metadata == null ? null : new MediaMetadata.Builder(metadata).build();

                MediaMetadata temp = metadata == null ? null : new MediaMetadata.Builder(metadata)

                        .build();

                // This is to guarantee that the underlying bundle is unparceled

                // before we set it to prevent concurrent reads from throwing an

                // exception

                temp.size();

                mMetadata = temp;

            }

            mHandler.post(MessageHandler.MSG_UPDATE_METADATA);

        }