Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd78085f authored by Mikhail Naganov's avatar Mikhail Naganov
Browse files

audio HAL - fix UAFs 

Bug: 185259758
Test: N/A
Change-Id: I5ec70b098a00746108e10ab39e966607d78c84ae
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
(cherry picked from commit a8ac7cf7)
parent c73a5227

audio/2.0/default/StreamIn.cpp

+4 −4
Original line number Diff line number Diff line
@@ -378,8 +378,8 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, 
    }



    // Create and launch the thread.

    auto tempReadThread = std::make_unique<ReadThread>(

        &mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

    sp<ReadThread> tempReadThread =

            new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                           tempStatusMQ.get(), tempElfGroup.get());

    if (!tempReadThread->init()) {

        ALOGW("failed to start reader thread: %s", strerror(-status));
@@ -396,7 +396,7 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mReadThread = tempReadThread.release();

    mReadThread = tempReadThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mReadThread->getTid();

audio/2.0/default/StreamOut.cpp

+4 −4
Original line number Diff line number Diff line
@@ -353,8 +353,8 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, 
    }



    // Create and launch the thread.

    auto tempWriteThread = std::make_unique<WriteThread>(

        &mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

    sp<WriteThread> tempWriteThread =

            new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                            tempStatusMQ.get(), tempElfGroup.get());

    if (!tempWriteThread->init()) {

        ALOGW("failed to start writer thread: %s", strerror(-status));
@@ -371,7 +371,7 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, 
    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mWriteThread = tempWriteThread.release();

    mWriteThread = tempWriteThread;

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.tid = mWriteThread->getTid();