Fix dangerous unsafe_get() in SensorRecord (ded526e8) · Commits · e / os / android_frameworks_native

services/sensorservice/SensorEventConnection.cpp

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -206,7 +206,7 @@ void SensorService::SensorEventConnection::incrementPendingFlushCount(int32_t ha
	status_t SensorService::SensorEventConnection::sendEvents(		status_t SensorService::SensorEventConnection::sendEvents(
	sensors_event_t const* buffer, size_t numEvents,		sensors_event_t const* buffer, size_t numEvents,
	sensors_event_t* scratch,		sensors_event_t* scratch,
	SensorEventConnection const * const * mapFlushEventsToConnections) {		wp<const SensorEventConnection> const * mapFlushEventsToConnections) {
	// filter out events not for this connection		// filter out events not for this connection
	int count = 0;		int count = 0;
	Mutex::Autolock _l(mConnectionLock);		Mutex::Autolock _l(mConnectionLock);
	@@ -234,7 +234,7 @@ status_t SensorService::SensorEventConnection::sendEvents(
	FlushInfo& flushInfo = mSensorInfo.editValueAt(index);		FlushInfo& flushInfo = mSensorInfo.editValueAt(index);
	// Check if there is a pending flush_complete event for this sensor on this connection.		// Check if there is a pending flush_complete event for this sensor on this connection.
	if (buffer[i].type == SENSOR_TYPE_META_DATA && flushInfo.mFirstFlushPending == true &&		if (buffer[i].type == SENSOR_TYPE_META_DATA && flushInfo.mFirstFlushPending == true &&
	this == mapFlushEventsToConnections[i]) {		mapFlushEventsToConnections[i] == this) {
	flushInfo.mFirstFlushPending = false;		flushInfo.mFirstFlushPending = false;
	ALOGD_IF(DEBUG_CONNECTIONS, "First flush event for sensor==%d ",		ALOGD_IF(DEBUG_CONNECTIONS, "First flush event for sensor==%d ",
	buffer[i].meta_data.sensor);		buffer[i].meta_data.sensor);
	@@ -255,7 +255,7 @@ status_t SensorService::SensorEventConnection::sendEvents(
	// from the same sensor_handle AND the current connection is mapped to the		// from the same sensor_handle AND the current connection is mapped to the
	// corresponding flush_complete_event.		// corresponding flush_complete_event.
	if (buffer[i].type == SENSOR_TYPE_META_DATA) {		if (buffer[i].type == SENSOR_TYPE_META_DATA) {
	if (this == mapFlushEventsToConnections[i]) {		if (mapFlushEventsToConnections[i] == this) {
	scratch[count++] = buffer[i];		scratch[count++] = buffer[i];
	}		}
	++i;		++i;

services/sensorservice/SensorEventConnection.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -52,7 +52,7 @@ public:
	bool isDataInjectionMode, const String16& opPackageName);		bool isDataInjectionMode, const String16& opPackageName);

	status_t sendEvents(sensors_event_t const* buffer, size_t count, sensors_event_t* scratch,		status_t sendEvents(sensors_event_t const* buffer, size_t count, sensors_event_t* scratch,
	SensorEventConnection const * const * mapFlushEventsToConnections = NULL);		wp<const SensorEventConnection> const * mapFlushEventsToConnections = NULL);
	bool hasSensor(int32_t handle) const;		bool hasSensor(int32_t handle) const;
	bool hasAnySensor() const;		bool hasAnySensor() const;
	bool hasOneShotSensors() const;		bool hasOneShotSensors() const;

services/sensorservice/SensorRecord.cpp

+8 −8

Original line number	Original line	Diff line number	Diff line
	@@ -21,13 +21,13 @@
	namespace android {		namespace android {

	SensorService::SensorRecord::SensorRecord(		SensorService::SensorRecord::SensorRecord(
	const sp<SensorEventConnection>& connection)		const sp<const SensorEventConnection>& connection)
	{		{
	mConnections.add(connection);		mConnections.add(connection);
	}		}

	bool SensorService::SensorRecord::addConnection(		bool SensorService::SensorRecord::addConnection(
	const sp<SensorEventConnection>& connection)		const sp<const SensorEventConnection>& connection)
	{		{
	if (mConnections.indexOf(connection) < 0) {		if (mConnections.indexOf(connection) < 0) {
	mConnections.add(connection);		mConnections.add(connection);
	@@ -37,16 +37,16 @@ bool SensorService::SensorRecord::addConnection(
	}		}

	bool SensorService::SensorRecord::removeConnection(		bool SensorService::SensorRecord::removeConnection(
	const wp<SensorEventConnection>& connection)		const wp<const SensorEventConnection>& connection)
	{		{
	ssize_t index = mConnections.indexOf(connection);		ssize_t index = mConnections.indexOf(connection);
	if (index >= 0) {		if (index >= 0) {
	mConnections.removeItemsAt(index, 1);		mConnections.removeItemsAt(index, 1);
	}		}
	// Remove this connections from the queue of flush() calls made on this sensor.		// Remove this connections from the queue of flush() calls made on this sensor.
	for (Vector< wp<SensorEventConnection> >::iterator it = mPendingFlushConnections.begin();		for (Vector< wp<const SensorEventConnection> >::iterator it = mPendingFlushConnections.begin();
	it != mPendingFlushConnections.end(); ) {		it != mPendingFlushConnections.end(); ) {
	if (it->unsafe_get() == connection.unsafe_get()) {		if (*it == connection) {
	it = mPendingFlushConnections.erase(it);		it = mPendingFlushConnections.erase(it);
	} else {		} else {
	++it;		++it;
	@@ -56,7 +56,7 @@ bool SensorService::SensorRecord::removeConnection(
	}		}

	void SensorService::SensorRecord::addPendingFlushConnection(		void SensorService::SensorRecord::addPendingFlushConnection(
	const sp<SensorEventConnection>& connection) {		const sp<const SensorEventConnection>& connection) {
	mPendingFlushConnections.add(connection);		mPendingFlushConnections.add(connection);
	}		}

	@@ -66,10 +66,10 @@ void SensorService::SensorRecord::removeFirstPendingFlushConnection() {
	}		}
	}		}

	SensorService::SensorEventConnection *		wp<const SensorService::SensorEventConnection>
	SensorService::SensorRecord::getFirstPendingFlushConnection() {		SensorService::SensorRecord::getFirstPendingFlushConnection() {
	if (mPendingFlushConnections.size() > 0) {		if (mPendingFlushConnections.size() > 0) {
	return mPendingFlushConnections[0].unsafe_get();		return mPendingFlushConnections[0];
	}		}
	return NULL;		return NULL;
	}		}

services/sensorservice/SensorRecord.h

+7 −7

Original line number	Original line	Diff line number	Diff line
	@@ -25,20 +25,20 @@ class SensorService;

	class SensorService::SensorRecord {		class SensorService::SensorRecord {
	public:		public:
	SensorRecord(const sp<SensorEventConnection>& connection);		SensorRecord(const sp<const SensorEventConnection>& connection);
	bool addConnection(const sp<SensorEventConnection>& connection);		bool addConnection(const sp<const SensorEventConnection>& connection);
	bool removeConnection(const wp<SensorEventConnection>& connection);		bool removeConnection(const wp<const SensorEventConnection>& connection);
	size_t getNumConnections() const { return mConnections.size(); }		size_t getNumConnections() const { return mConnections.size(); }

	void addPendingFlushConnection(const sp<SensorEventConnection>& connection);		void addPendingFlushConnection(const sp<const SensorEventConnection>& connection);
	void removeFirstPendingFlushConnection();		void removeFirstPendingFlushConnection();
	SensorEventConnection * getFirstPendingFlushConnection();		wp<const SensorEventConnection> getFirstPendingFlushConnection();
	void clearAllPendingFlushConnections();		void clearAllPendingFlushConnections();
	private:		private:
	SortedVector< wp<SensorEventConnection> > mConnections;		SortedVector< wp<const SensorEventConnection> > mConnections;
	// A queue of all flush() calls made on this sensor. Flush complete events		// A queue of all flush() calls made on this sensor. Flush complete events
	// will be sent in this order.		// will be sent in this order.
	Vector< wp<SensorEventConnection> > mPendingFlushConnections;		Vector< wp<const SensorEventConnection> > mPendingFlushConnections;
	};		};

	}		}

services/sensorservice/SensorService.cpp

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -260,7 +260,7 @@ void SensorService::onFirstRef() {
	const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;		const size_t minBufferSize = SensorEventQueue::MAX_RECEIVE_BUFFER_EVENT_COUNT;
	mSensorEventBuffer = new sensors_event_t[minBufferSize];		mSensorEventBuffer = new sensors_event_t[minBufferSize];
	mSensorEventScratch = new sensors_event_t[minBufferSize];		mSensorEventScratch = new sensors_event_t[minBufferSize];
	mMapFlushEventsToConnections = new SensorEventConnection const * [minBufferSize];		mMapFlushEventsToConnections = new wp<const SensorEventConnection> [minBufferSize];
	mCurrentOperatingMode = NORMAL;		mCurrentOperatingMode = NORMAL;

	mNextSensorRegIndex = 0;		mNextSensorRegIndex = 0;