Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06234b37 authored by Jeff Brown's avatar Jeff Brown Committed by The Android Automerger
Browse files

Fix a leak in Parcel::writeBlob. 

Was mistakenly assuming that Parcel::writeFileDescriptor took
ownership of the fd that was passed in.  It does not!
Added some comments and a default parameter to allow the caller
to specify whether it wishes the Parcel to take ownership.

Bug: 5563374
Change-Id: I5a12f51d582bf246ce90133cce7690bb9bca93f6
parent e8dc810f

include/binder/Parcel.h

+2 −1
Original line number Original line Diff line number Diff line
@@ -110,7 +110,8 @@ public: 
    

    

    // Place a file descriptor into the parcel.  The given fd must remain

    // Place a file descriptor into the parcel.  The given fd must remain

    // valid for the lifetime of the parcel.

    // valid for the lifetime of the parcel.

    status_t            writeFileDescriptor(int fd);

    // The Parcel does not take ownership of the given fd unless you ask it to.

    status_t            writeFileDescriptor(int fd, bool takeOwnership = false);

    

    

    // Place a file descriptor into the parcel.  A dup of the fd is made, which

    // Place a file descriptor into the parcel.  A dup of the fd is made, which

    // will be closed once the parcel is destroyed.

    // will be closed once the parcel is destroyed.

libs/binder/Parcel.cpp

+4 −9
Original line number Original line Diff line number Diff line
@@ -710,24 +710,19 @@ status_t Parcel::writeNativeHandle(const native_handle* handle) 
    return err;

    return err;

}

}





status_t Parcel::writeFileDescriptor(int fd)

status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership)

{

{

    flat_binder_object obj;

    flat_binder_object obj;

    obj.type = BINDER_TYPE_FD;

    obj.type = BINDER_TYPE_FD;

    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

    obj.handle = fd;

    obj.handle = fd;

    obj.cookie = (void*)0;

    obj.cookie = (void*) (takeOwnership ? 1 : 0);

    return writeObject(obj, true);

    return writeObject(obj, true);

}

}





status_t Parcel::writeDupFileDescriptor(int fd)

status_t Parcel::writeDupFileDescriptor(int fd)

{

{

    flat_binder_object obj;

    return writeFileDescriptor(dup(fd), true /*takeOwnership*/);

    obj.type = BINDER_TYPE_FD;

    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

    obj.handle = dup(fd);

    obj.cookie = (void*)1;

    return writeObject(obj, true);

}

}





status_t Parcel::writeBlob(size_t len, WritableBlob* outBlob)

status_t Parcel::writeBlob(size_t len, WritableBlob* outBlob)
@@ -764,7 +759,7 @@ status_t Parcel::writeBlob(size_t len, WritableBlob* outBlob) 
            } else {

            } else {

                status = writeInt32(1);

                status = writeInt32(1);

                if (!status) {

                if (!status) {

                    status = writeFileDescriptor(fd);

                    status = writeFileDescriptor(fd, true /*takeOwnership*/);

                    if (!status) {

                    if (!status) {

                        outBlob->init(true /*mapped*/, ptr, len);

                        outBlob->init(true /*mapped*/, ptr, len);

                        return NO_ERROR;

                        return NO_ERROR;