Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 476f203f authored by Hui Peng's avatar Hui Peng Committed by Automerger Merge Worker
Browse files

Fix a use-after-free bug in AttributionProcessor::OnWakelockReleased am: 15fbebc8 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20606225



Change-Id: If32f1b50b3cc11e865600e8abef8ddb6fff1be4a
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 44262377 15fbebc8

system/gd/btaa/linux_generic/attribution_processor.cc

+14 −8
Original line number Original line Diff line number Diff line
@@ -126,23 +126,29 @@ void AttributionProcessor::OnWakelockReleased(uint32_t duration_ms) { 
  }

  }

  // Trim down the transient entries in the aggregator to avoid that it overgrows

  // Trim down the transient entries in the aggregator to avoid that it overgrows

  if (btaa_aggregator_.size() > kMapSizeTrimDownAggregationEntry) {

  if (btaa_aggregator_.size() > kMapSizeTrimDownAggregationEntry) {

    for (auto& it : btaa_aggregator_) {

    auto it = btaa_aggregator_.begin();

    while (it != btaa_aggregator_.end()) {

      auto elapsed_time_sec =

      auto elapsed_time_sec =

          std::chrono::duration_cast<std::chrono::seconds>(cur_time - it.second.creation_time).count();

          std::chrono::duration_cast<std::chrono::seconds>(cur_time - it->second.creation_time).count();

      if (elapsed_time_sec > kDurationTransientDeviceActivityEntrySecs &&

      if (elapsed_time_sec > kDurationTransientDeviceActivityEntrySecs &&

          it.second.byte_count < kByteCountTransientDeviceActivityEntry) {

          it->second.byte_count < kByteCountTransientDeviceActivityEntry) {

        btaa_aggregator_.erase(it.first);

        it = btaa_aggregator_.erase(it);

      } else {

        it++;

      }

      }

    }

    }

  }

  }





  if (app_activity_aggregator_.size() > kMapSizeTrimDownAggregationEntry) {

  if (app_activity_aggregator_.size() > kMapSizeTrimDownAggregationEntry) {

    for (auto& it : app_activity_aggregator_) {

    auto it = app_activity_aggregator_.begin();

    while (it != app_activity_aggregator_.end()) {

      auto elapsed_time_sec =

      auto elapsed_time_sec =

          std::chrono::duration_cast<std::chrono::seconds>(cur_time - it.second.creation_time).count();

          std::chrono::duration_cast<std::chrono::seconds>(cur_time - it->second.creation_time).count();

      if (elapsed_time_sec > kDurationTransientDeviceActivityEntrySecs &&

      if (elapsed_time_sec > kDurationTransientDeviceActivityEntrySecs &&

          it.second.byte_count < kByteCountTransientDeviceActivityEntry) {

          it->second.byte_count < kByteCountTransientDeviceActivityEntry) {

        app_activity_aggregator_.erase(it.first);

        it = app_activity_aggregator_.erase(it);

      } else {

        it++;

      }

      }

    }

    }

  }

  }