Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da947d51 authored by Steven Moreland's avatar Steven Moreland Committed by Automerger Merge Worker
Browse files

audio HAL - fix UAFs am: 7283cbe8 am: e227bfd1 am: facfee63 

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414

Change-Id: I50df59e828d44606c2fca8dc44830b5def4f9670
parents 041e19dd facfee63

audio/core/all-versions/default/StreamIn.cpp

+4 −4
Original line number Original line Diff line number Diff line
@@ -390,9 +390,9 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    }

    }





    // Create and launch the thread.

    // Create and launch the thread.

    auto tempReadThread =

    sp<ReadThread> tempReadThread =

        std::make_unique<ReadThread>(&mStopReadThread, mStream, tempCommandMQ.get(),

            new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                                     tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

                           tempStatusMQ.get(), tempElfGroup.get());

    if (!tempReadThread->init()) {

    if (!tempReadThread->init()) {

        ALOGW("failed to start reader thread: %s", strerror(-status));

        ALOGW("failed to start reader thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);

        sendError(Result::INVALID_ARGUMENTS);
@@ -408,7 +408,7 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun 
    mCommandMQ = std::move(tempCommandMQ);

    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mReadThread = tempReadThread.release();

    mReadThread = tempReadThread;

    mEfGroup = tempElfGroup.release();

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.pid = getpid();

    threadInfo.tid = mReadThread->getTid();

    threadInfo.tid = mReadThread->getTid();

audio/core/all-versions/default/StreamOut.cpp

+4 −4
Original line number Original line Diff line number Diff line
@@ -376,9 +376,9 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    }

    }





    // Create and launch the thread.

    // Create and launch the thread.

    auto tempWriteThread =

    sp<WriteThread> tempWriteThread =

        std::make_unique<WriteThread>(&mStopWriteThread, mStream, tempCommandMQ.get(),

            new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),

                                      tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());

                            tempStatusMQ.get(), tempElfGroup.get());

    if (!tempWriteThread->init()) {

    if (!tempWriteThread->init()) {

        ALOGW("failed to start writer thread: %s", strerror(-status));

        ALOGW("failed to start writer thread: %s", strerror(-status));

        sendError(Result::INVALID_ARGUMENTS);

        sendError(Result::INVALID_ARGUMENTS);
@@ -394,7 +394,7 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou 
    mCommandMQ = std::move(tempCommandMQ);

    mCommandMQ = std::move(tempCommandMQ);

    mDataMQ = std::move(tempDataMQ);

    mDataMQ = std::move(tempDataMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mStatusMQ = std::move(tempStatusMQ);

    mWriteThread = tempWriteThread.release();

    mWriteThread = tempWriteThread;

    mEfGroup = tempElfGroup.release();

    mEfGroup = tempElfGroup.release();

    threadInfo.pid = getpid();

    threadInfo.pid = getpid();

    threadInfo.tid = mWriteThread->getTid();

    threadInfo.tid = mWriteThread->getTid();