diff options
| author | Lajos Molnar <lajos@google.com> | 2017-09-06 19:41:19 -0700 |
|---|---|---|
| committer | Baligh Uddin <baligh@google.com> | 2017-11-08 14:27:29 -0800 |
| commit | 2019a5e7a585d932ab5b12d7b31da46ca4daa64e (patch) | |
| tree | 54b411012fb5c847a8b8aa364fb49b88b3cbe4fe | |
| parent | 110b6731d3932b63591ba516257ed03ebe6c9e6b (diff) | |
| download | av-oreo-r4-release.tar.gz | |
OMXNodeInstance: use a lock around OMX::freeNodeandroid-8.0.0_r35oreo-r4-release
This is to avoid a concurrent use after free if other OMX commands
are being executed before the node is marked as deleted.
Bug: 63666573
Change-Id: I7720dd900bfa252f8675e0c56191adbf52aa957e
| -rw-r--r-- | media/libstagefright/omx/OMXNodeInstance.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp index 00b3c7ba8e..34ecb22e42 100644 --- a/media/libstagefright/omx/OMXNodeInstance.cpp +++ b/media/libstagefright/omx/OMXNodeInstance.cpp @@ -488,6 +488,9 @@ status_t OMXNodeInstance::freeNode() { LOG_ALWAYS_FATAL("unknown state %s(%#x).", asString(state), state); break; } + + Mutex::Autolock _l(mLock); + status_t err = mOwner->freeNode(this); mDispatcher.clear(); |