Fix bug 5357295 NPE on display when remote control client dies

When a IRemoteControlClient dies, that client is set to null
 in the stack of remote control entries (mRCStack). This is done
 by calling registerRemoteControlClient() with a null client.
The bug is that registerRemoteControlClient(), after storing
 the new client, uses it to let it know what the current
 remote control display is. When that display is non null, the
 client is sent the current display. So when a client died
 when there was a display, the client reference was accessed
 in the part of the method where we haven't yet checked whether
 it is null or not.
The fix consists in moving the setting of the display on the
 client (method plugRemoteControlDisplay) only after having
 checked that the client is non-null.

Change-Id: Ic74d6cba9e3a3a16e78cd80a1ae5901abfeb3905

1 files changed, 18 insertions, 10 deletions

diff --git a/media/java/android/media/AudioService.java b/media/java/android/media/AudioService.java
index 8895c9e..4f4f929 100644
--- a/media/java/android/media/AudioService.java
+++ b/media/java/android/media/AudioService.java
@@ -2958,7 +2958,7 @@ public class AudioService extends IAudioService.Stub {
             Log.w(TAG, "  RemoteControlClient died");
             // remote control client died, make sure the displays don't use it anymore
             //  by setting its remote control client to null
-            registerRemoteControlClient(mMediaIntent, null, null/*ignored*/);
+            registerRemoteControlClient(mMediaIntent, null/*rcClient*/, null/*ignored*/);
         }
 
         public IBinder getBinder() {
@@ -3366,7 +3366,12 @@ public class AudioService extends IAudioService.Stub {
         }
     }
 
-    /** see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...) */
+    /**
+     * see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...)
+     * Note: using this method with rcClient == null is a way to "disable" the IRemoteControlClient
+     *     without modifying the RC stack, but while still causing the display to refresh (will
+     *     become blank as a result of this)
+     */
     public void registerRemoteControlClient(PendingIntent mediaIntent,
             IRemoteControlClient rcClient, String callingPackageName) {
         if (DEBUG_RC) Log.i(TAG, "Register remote control client rcClient="+rcClient);
@@ -3384,6 +3389,15 @@ public class AudioService extends IAudioService.Stub {
                         }
                         // save the new remote control client
                         rcse.mRcClient = rcClient;
+                        rcse.mCallingPackageName = callingPackageName;
+                        rcse.mCallingUid = Binder.getCallingUid();
+                        if (rcClient == null) {
+                            rcse.mRcClientDeathHandler = null;
+                            break;
+                        }
+
+                        // there is a new (non-null) client:
+                        // 1/ give the new client the current display (if any)
                         if (mRcDisplay != null) {
                             try {
                                 rcse.mRcClient.plugRemoteControlDisplay(mRcDisplay);
@@ -3392,14 +3406,8 @@ public class AudioService extends IAudioService.Stub {
                                 e.printStackTrace();
                             }
                         }
-                        rcse.mCallingPackageName = callingPackageName;
-                        rcse.mCallingUid = Binder.getCallingUid();
-                        if (rcClient == null) {
-                            rcse.mRcClientDeathHandler = null;
-                            break;
-                        }
-                        // monitor the new client's death
-                        IBinder b = rcClient.asBinder();
+                        // 2/ monitor the new client's death
+                        IBinder b = rcse.mRcClient.asBinder();
                         RcClientDeathHandler rcdh =
                                 new RcClientDeathHandler(b, rcse.mMediaIntent);
                         try {