Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5d0c550 authored by Daniel Zheng's avatar Daniel Zheng
Browse files

bootctl: pass cookie to death recipient 

On binder death, the cookie is the value that is passed to the death
recipient. This value shouldn't be nullptr here since our onDeath()
function expects an instance of BootControlClientAidl. If that doesn't
exist, we have a null pointer dereference which will cause update_engine
to crash.

Bug: 369289491
Test: crash bootctl service
Change-Id: I0bed4680c23b7d3516ed43aa566c4474962244fa
parent cba98610

boot/aidl/client/BootControlClient.cpp

+2 −2
Original line number Diff line number Diff line
@@ -69,8 +69,8 @@ class BootControlClientAidl final : public BootControlClient { 
    explicit BootControlClientAidl(std::shared_ptr<IBootControl> module)

        : module_(module),

          boot_control_death_recipient(AIBinder_DeathRecipient_new(onBootControlServiceDied)) {

        binder_status_t status = AIBinder_linkToDeath(module->asBinder().get(),

                                                      boot_control_death_recipient, nullptr);

        binder_status_t status =

                AIBinder_linkToDeath(module->asBinder().get(), boot_control_death_recipient, this);

        if (status != STATUS_OK) {

            LOG(ERROR) << "Could not link to binder death";

            return;