Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6713a4f7 authored by Xusong Wang's avatar Xusong Wang Committed by Automerger Merge Worker
Browse files

Fix use-after-free crash in VtsHalNeuralnetworksTargetTest. am: dee204e1 

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/15694529

Change-Id: I569c04dde3fd34564dcfc5b34d50ecad69f6d614
parents 269219cb dee204e1

neuralnetworks/aidl/vts/functional/Utils.cpp

+6 −13
Original line number Original line Diff line number Diff line
@@ -153,26 +153,19 @@ void TestBlobAHWB::initialize(uint32_t size) { 
            .stride = size,

            .stride = size,

    };

    };





    ASSERT_EQ(AHardwareBuffer_allocate(&desc, &mAhwb), 0);

    AHardwareBuffer* ahwb = nullptr;

    ASSERT_NE(mAhwb, nullptr);

    ASSERT_EQ(AHardwareBuffer_allocate(&desc, &ahwb), 0);

    ASSERT_NE(ahwb, nullptr);





    const auto sharedMemory =

    mMemory = nn::createSharedMemoryFromAHWB(ahwb, /*takeOwnership=*/true).value();

            nn::createSharedMemoryFromAHWB(mAhwb, /*takeOwnership=*/false).value();

    mMapping = nn::map(mMemory).value();

    mMapping = nn::map(sharedMemory).value();

    mPtr = static_cast<uint8_t*>(std::get<void*>(mMapping.pointer));

    mPtr = static_cast<uint8_t*>(std::get<void*>(mMapping.pointer));

    CHECK_NE(mPtr, nullptr);

    CHECK_NE(mPtr, nullptr);

    mAidlMemory = utils::convert(sharedMemory).value();

    mAidlMemory = utils::convert(mMemory).value();





    mIsValid = true;

    mIsValid = true;

}

}





TestBlobAHWB::~TestBlobAHWB() {

    if (mAhwb) {

        AHardwareBuffer_unlock(mAhwb, nullptr);

        AHardwareBuffer_release(mAhwb);

    }

}



std::string gtestCompliantName(std::string name) {

std::string gtestCompliantName(std::string name) {

    // gtest test names must only contain alphanumeric characters

    // gtest test names must only contain alphanumeric characters

    std::replace_if(

    std::replace_if(

neuralnetworks/aidl/vts/functional/Utils.h

+1 −2
Original line number Original line Diff line number Diff line
@@ -102,11 +102,10 @@ class TestBlobAHWB : public TestMemoryBase { 
    // The constructor calls initialize, which constructs the memory resources. This is a

    // The constructor calls initialize, which constructs the memory resources. This is a

    // workaround that gtest macros cannot be used directly in a constructor.

    // workaround that gtest macros cannot be used directly in a constructor.

    TestBlobAHWB(uint32_t size) { initialize(size); }

    TestBlobAHWB(uint32_t size) { initialize(size); }

    ~TestBlobAHWB();





  private:

  private:

    void initialize(uint32_t size);

    void initialize(uint32_t size);

    AHardwareBuffer* mAhwb = nullptr;

    nn::SharedMemory mMemory;

    nn::Mapping mMapping;

    nn::Mapping mMapping;

};

};