Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc36f977 authored by Peng Xu's avatar Peng Xu Committed by android-build-merger
Browse files

Fix dangerous unsafe_get() in SensorRecord am: eb05947a 

am: 8781d839

Change-Id: I9cbddcdc0c7e0bc549d476dbb85fe3da67cc69d5
parents 00464faf 8781d839

services/sensorservice/SensorEventConnection.cpp

+3 −3
Original line number Diff line number Diff line
@@ -206,7 +206,7 @@ void SensorService::SensorEventConnection::incrementPendingFlushCount(int32_t ha 
status_t SensorService::SensorEventConnection::sendEvents(

        sensors_event_t const* buffer, size_t numEvents,

        sensors_event_t* scratch,

        SensorEventConnection const * const * mapFlushEventsToConnections) {

        wp<const SensorEventConnection> const * mapFlushEventsToConnections) {

    // filter out events not for this connection

    int count = 0;

    Mutex::Autolock _l(mConnectionLock);
@@ -234,7 +234,7 @@ status_t SensorService::SensorEventConnection::sendEvents( 
            FlushInfo& flushInfo = mSensorInfo.editValueAt(index);

            // Check if there is a pending flush_complete event for this sensor on this connection.

            if (buffer[i].type == SENSOR_TYPE_META_DATA && flushInfo.mFirstFlushPending == true &&

                    this == mapFlushEventsToConnections[i]) {

                    mapFlushEventsToConnections[i] == this) {

                flushInfo.mFirstFlushPending = false;

                ALOGD_IF(DEBUG_CONNECTIONS, "First flush event for sensor==%d ",

                        buffer[i].meta_data.sensor);
@@ -255,7 +255,7 @@ status_t SensorService::SensorEventConnection::sendEvents( 
                // from the same sensor_handle AND the current connection is mapped to the

                // corresponding flush_complete_event.

                if (buffer[i].type == SENSOR_TYPE_META_DATA) {

                    if (this == mapFlushEventsToConnections[i]) {

                    if (mapFlushEventsToConnections[i] == this) {

                        scratch[count++] = buffer[i];

                    }

                    ++i;

services/sensorservice/SensorEventConnection.h

+1 −1
Original line number Diff line number Diff line
@@ -52,7 +52,7 @@ public: 
                          bool isDataInjectionMode, const String16& opPackageName);



    status_t sendEvents(sensors_event_t const* buffer, size_t count, sensors_event_t* scratch,

                        SensorEventConnection const * const * mapFlushEventsToConnections = NULL);

                        wp<const SensorEventConnection> const * mapFlushEventsToConnections = NULL);

    bool hasSensor(int32_t handle) const;

    bool hasAnySensor() const;

    bool hasOneShotSensors() const;

services/sensorservice/SensorRecord.cpp

+8 −8
Original line number Diff line number Diff line
@@ -21,13 +21,13 @@ 
namespace android {



SensorService::SensorRecord::SensorRecord(

        const sp<SensorEventConnection>& connection)

        const sp<const SensorEventConnection>& connection)

{

    mConnections.add(connection);

}



bool SensorService::SensorRecord::addConnection(

        const sp<SensorEventConnection>& connection)

        const sp<const SensorEventConnection>& connection)

{

    if (mConnections.indexOf(connection) < 0) {

        mConnections.add(connection);
@@ -37,16 +37,16 @@ bool SensorService::SensorRecord::addConnection( 
}



bool SensorService::SensorRecord::removeConnection(

        const wp<SensorEventConnection>& connection)

        const wp<const SensorEventConnection>& connection)

{

    ssize_t index = mConnections.indexOf(connection);

    if (index >= 0) {

        mConnections.removeItemsAt(index, 1);

    }

    // Remove this connections from the queue of flush() calls made on this sensor.

    for (Vector< wp<SensorEventConnection> >::iterator it = mPendingFlushConnections.begin();

    for (Vector< wp<const SensorEventConnection> >::iterator it = mPendingFlushConnections.begin();

            it != mPendingFlushConnections.end(); ) {

        if (it->unsafe_get() == connection.unsafe_get()) {

        if (*it == connection) {

            it = mPendingFlushConnections.erase(it);

        } else {

            ++it;
@@ -56,7 +56,7 @@ bool SensorService::SensorRecord::removeConnection( 
}



void SensorService::SensorRecord::addPendingFlushConnection(

        const sp<SensorEventConnection>& connection) {

        const sp<const SensorEventConnection>& connection) {

    mPendingFlushConnections.add(connection);

}
@@ -66,10 +66,10 @@ void SensorService::SensorRecord::removeFirstPendingFlushConnection() { 
    }

}



SensorService::SensorEventConnection *

wp<const SensorService::SensorEventConnection>

        SensorService::SensorRecord::getFirstPendingFlushConnection() {

    if (mPendingFlushConnections.size() > 0) {

        return mPendingFlushConnections[0].unsafe_get();

        return mPendingFlushConnections[0];

    }

    return NULL;

}

services/sensorservice/SensorRecord.h

+7 −7
Original line number Diff line number Diff line
@@ -25,20 +25,20 @@ class SensorService; 


class SensorService::SensorRecord {

public:

    SensorRecord(const sp<SensorEventConnection>& connection);

    bool addConnection(const sp<SensorEventConnection>& connection);

    bool removeConnection(const wp<SensorEventConnection>& connection);

    SensorRecord(const sp<const SensorEventConnection>& connection);

    bool addConnection(const sp<const SensorEventConnection>& connection);

    bool removeConnection(const wp<const SensorEventConnection>& connection);

    size_t getNumConnections() const { return mConnections.size(); }



    void addPendingFlushConnection(const sp<SensorEventConnection>& connection);

    void addPendingFlushConnection(const sp<const SensorEventConnection>& connection);

    void removeFirstPendingFlushConnection();

    SensorEventConnection * getFirstPendingFlushConnection();

    wp<const SensorEventConnection> getFirstPendingFlushConnection();

    void clearAllPendingFlushConnections();

private:

    SortedVector< wp<SensorEventConnection> > mConnections;

    SortedVector< wp<const SensorEventConnection> > mConnections;

    // A queue of all flush() calls made on this sensor. Flush complete events

    // will be sent in this order.

    Vector< wp<SensorEventConnection> > mPendingFlushConnections;

    Vector< wp<const SensorEventConnection> > mPendingFlushConnections;

};



}

services/sensorservice/SensorService.cpp

+1 −1
Original line number Diff line number Diff line
@@ -260,7 +260,7 @@ void SensorService::onFirstRef() { 
            const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;

            mSensorEventBuffer = new sensors_event_t[minBufferSize];

            mSensorEventScratch = new sensors_event_t[minBufferSize];

            mMapFlushEventsToConnections = new SensorEventConnection const * [minBufferSize];

            mMapFlushEventsToConnections = new wp<const SensorEventConnection> [minBufferSize];

            mCurrentOperatingMode = NORMAL;



            mNextSensorRegIndex = 0;