Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eab2a231 authored by chaviw's avatar chaviw
Browse files

Check for null buffer when calling Transaction#setBuffer 

android_hardware_HardwareBuffer_getNativeHardwareBuffer will crash when
trying to convert a null object to a GraphicBuffer. Instead, just set
the GraphicBuffer to null and call into SCC with a null buffer. This
will result in the previous buffer getting released

Test: SurfaceControlTest
Fixes: 233252754
Change-Id: Idc9f5ca3d747dbc890d7cafb9512c51ca9e711c9
parent 4304b4b0

core/jni/android_view_SurfaceControl.cpp

+5 −2
Original line number Diff line number Diff line
@@ -688,8 +688,11 @@ static void nativeSetBuffer(JNIEnv* env, jclass clazz, jlong transactionObj, jlo 
                            jobject bufferObject, jlong fencePtr, jobject releaseCallback) {

    auto transaction = reinterpret_cast<SurfaceComposerClient::Transaction*>(transactionObj);

    SurfaceControl* const ctrl = reinterpret_cast<SurfaceControl*>(nativeObject);

    sp<GraphicBuffer> graphicBuffer(GraphicBuffer::fromAHardwareBuffer(

            android_hardware_HardwareBuffer_getNativeHardwareBuffer(env, bufferObject)));

    sp<GraphicBuffer> graphicBuffer;

    if (bufferObject != nullptr) {

        graphicBuffer = GraphicBuffer::fromAHardwareBuffer(

                android_hardware_HardwareBuffer_getNativeHardwareBuffer(env, bufferObject));

    }

    std::optional<sp<Fence>> optFence = std::nullopt;

    if (fencePtr != 0) {

        optFence = sp<Fence>{reinterpret_cast<Fence*>(fencePtr)};