Fixed possible heap corruption in EffectDesc
"EffectDesc *effect = new EffectDesc(*effects[i]);" was relying on the default copy constructor for EffectDesc, but the default copy constructor does a member-by-member copy. This works OK for mUuid, but a member copy of mName and mParams shares pointers. This could result in heap corruption later on due to a double free. Changed to add an explicit copy constructor that does a deep copy of both mName and mParams. A malloc() and strdup() were being freed by delete, but the correct matching API for these is free(). Fortunately our current memory runtime implementation ignores the difference. Changed to use free(). EffectDesc and InputSourceDesc member fields were being torn down by the code that does delete. Changed to do the tear-down in ~EffectDesc() and ~InputSourceDesc(). Added constructor EffectDesc() with name and UUID parameters, rather than having caller fill in the object after construction. Made ~EffectDesc() and ~InputSourceDesc() non-virtual to save memory, since they have no subclasses. Change-Id: Ibb5cc2e6760d72e0c4cf537068ac4432c717bafd
Loading
Please register or sign in to comment