Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d7f2600 authored by Steven Moreland's avatar Steven Moreland Committed by Automerger Merge Worker
Browse files

audio HAL - fix UAFs am: 7283cbe8 am: e227bfd1 am: facfee63 

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414

Change-Id: I2c6be9f57fe8c2f11f18f4ab3c330b36972f128c
parents 647f9a62 facfee63

audio/core/all-versions/default/StreamIn.cpp

+4 −4
Original line number Diff line number Diff line
@@ -390,9 +390,9 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    }



    // Create and launch the thread.

    auto tempReadThread =

        std::make_unique<ReadThread>(&mStopReadThread, mStream, tempCommandMQ.get(),

                                     tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

    sp<ReadThread> tempReadThread =

            new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                           tempStatusMQ.get(), tempElfGroup.get());

    if (!tempReadThread->init()) {

        ALOGW("failed to start reader thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);
@@ -408,7 +408,7 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mReadThread = tempReadThread.release();

    mReadThread = tempReadThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mReadThread->getTid();

audio/core/all-versions/default/StreamOut.cpp

+4 −4
Original line number Diff line number Diff line
@@ -376,9 +376,9 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    }



    // Create and launch the thread.

    auto tempWriteThread =

        std::make_unique<WriteThread>(&mStopWriteThread, mStream, tempCommandMQ.get(),

                                      tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

    sp<WriteThread> tempWriteThread =

            new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                            tempStatusMQ.get(), tempElfGroup.get());

    if (!tempWriteThread->init()) {

        ALOGW("failed to start writer thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);
@@ -394,7 +394,7 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mWriteThread = tempWriteThread.release();

    mWriteThread = tempWriteThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mWriteThread->getTid();