Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f0fe27a authored by Steven Moreland's avatar Steven Moreland Committed by android-build-team Robot
Browse files

audio HAL - fix UAFs 

Bug: 185259758
Test: N/A
Change-Id: I5ec70b098a00746108e10ab39e966607d78c84ae
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
(cherry picked from commit a8ac7cf7)
(cherry picked from commit 7283cbe8)
parent 15d34e3a

audio/core/all-versions/default/StreamIn.cpp

+4 −4
Original line number Diff line number Diff line
@@ -390,9 +390,9 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    }



    // Create and launch the thread.

    auto tempReadThread =

        std::make_unique<ReadThread>(&mStopReadThread, mStream, tempCommandMQ.get(),

                                     tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

    sp<ReadThread> tempReadThread =

            new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                           tempStatusMQ.get(), tempElfGroup.get());

    if (!tempReadThread->init()) {

        ALOGW("failed to start reader thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);
@@ -408,7 +408,7 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mReadThread = tempReadThread.release();

    mReadThread = tempReadThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mReadThread->getTid();

audio/core/all-versions/default/StreamOut.cpp

+4 −4
Original line number Diff line number Diff line
@@ -376,9 +376,9 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    }



    // Create and launch the thread.

    auto tempWriteThread =

        std::make_unique<WriteThread>(&mStopWriteThread, mStream, tempCommandMQ.get(),

                                      tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

    sp<WriteThread> tempWriteThread =

            new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                            tempStatusMQ.get(), tempElfGroup.get());

    if (!tempWriteThread->init()) {

        ALOGW("failed to start writer thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);
@@ -394,7 +394,7 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mWriteThread = tempWriteThread.release();

    mWriteThread = tempWriteThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mWriteThread->getTid();