Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e88055bb authored by Steven Moreland's avatar Steven Moreland
Browse files

libbinder_ndk: fix UB memory access for race 

AIBinder_DeathRecipient holds a strong pointer to its internal class
TransferDeathRecipient. If a user deletes a death recipient at the
same time a binder dies, the TDR still holds a reference to the
AIBinder_DeathRecipient object that may be invalidated.

Bug: N/A
Test: build, boot, and ./runtests.sh
Change-Id: Ic4cbc50c2d85ce52e36d4b157a50d0c75048e664
parent 873f4999

libs/binder/ndk/ibinder_internal.h

+2 −2
Original line number Original line Diff line number Diff line
@@ -133,7 +133,7 @@ struct AIBinder_DeathRecipient { 
    // binderDied receipt only gives us information about the IBinder.

    // binderDied receipt only gives us information about the IBinder.

    struct TransferDeathRecipient : ::android::IBinder::DeathRecipient {

    struct TransferDeathRecipient : ::android::IBinder::DeathRecipient {

        TransferDeathRecipient(const ::android::wp<::android::IBinder>& who, void* cookie,

        TransferDeathRecipient(const ::android::wp<::android::IBinder>& who, void* cookie,

                               const AIBinder_DeathRecipient_onBinderDied& onDied)

                               const AIBinder_DeathRecipient_onBinderDied onDied)

            : mWho(who), mCookie(cookie), mOnDied(onDied) {}

            : mWho(who), mCookie(cookie), mOnDied(onDied) {}





        void binderDied(const ::android::wp<::android::IBinder>& who) override;

        void binderDied(const ::android::wp<::android::IBinder>& who) override;
@@ -144,7 +144,7 @@ struct AIBinder_DeathRecipient { 
       private:

       private:

        ::android::wp<::android::IBinder> mWho;

        ::android::wp<::android::IBinder> mWho;

        void* mCookie;

        void* mCookie;

        const AIBinder_DeathRecipient_onBinderDied& mOnDied;

        const AIBinder_DeathRecipient_onBinderDied mOnDied;

    };

    };





    explicit AIBinder_DeathRecipient(AIBinder_DeathRecipient_onBinderDied onDied);

    explicit AIBinder_DeathRecipient(AIBinder_DeathRecipient_onBinderDied onDied);