Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 80f75f4d authored by Andre Eisenbach's avatar Andre Eisenbach
Browse files

Protect against Bluetooth share crash because of invalid timer callback 

If the timer callback is not set when fired, a SIGSEGV will ensue. This
patch checks to make sure the callback is set before invoking the
function.

Bug: 17307367
Change-Id: I2ee284bdbd3b54a368e373d9ac9e6e47205dcff6
parent be1f5438

android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp

+11 −4
Original line number Diff line number Diff line
@@ -507,11 +507,14 @@ static bool set_wake_alarm_callout(uint64_t delay_millis, bool should_wake, alar 
        return false;

    }



    jboolean jshould_wake = should_wake ? JNI_TRUE : JNI_FALSE;

    jboolean ret = env->CallBooleanMethod(sJniAdapterServiceObj, method_setWakeAlarm, (jlong)delay_millis, jshould_wake);

    if (ret) {

    sAlarmCallback = cb;

    sAlarmCallbackData = data;



    jboolean jshould_wake = should_wake ? JNI_TRUE : JNI_FALSE;

    jboolean ret = env->CallBooleanMethod(sJniAdapterServiceObj, method_setWakeAlarm, (jlong)delay_millis, jshould_wake);

    if (!ret) {

        sAlarmCallback = NULL;

        sAlarmCallbackData = NULL;

    }



    if (status == JNI_EDETACHED) {
@@ -586,7 +589,11 @@ static int release_wake_lock_callout(const char *lock_name) { 
// Called by Java code when alarm is fired. A wake lock is held by the caller

// over the duration of this callback.

static void alarmFiredNative(JNIEnv *env, jobject obj) {

    if (sAlarmCallback) {

        sAlarmCallback(sAlarmCallbackData);

    } else {

        ALOGE("%s() - Alarm fired with callback not set!", __FUNCTION__);

    }

}



static void remote_mas_instances_callback(bt_status_t status, bt_bdaddr_t *bd_addr,