am a78601dc: Merge "Ensure metadata bundles are unparceled before making them available" into lmp-dev

* commit 'a78601dc1929428007fdbb07da0a07ae3fb60bd5':
  Ensure metadata bundles are unparceled before making them available

1 files changed, 11 insertions, 7 deletions

diff --git a/services/core/java/com/android/server/media/MediaSessionRecord.java b/services/core/java/com/android/server/media/MediaSessionRecord.java
index a0ec1d5..ebce3ad 100644
--- a/services/core/java/com/android/server/media/MediaSessionRecord.java
+++ b/services/core/java/com/android/server/media/MediaSessionRecord.java
@@ -625,12 +625,12 @@ public class MediaSessionRecord implements IBinder.DeathRecipient {
 
     private PlaybackState getStateWithUpdatedPosition() {
         PlaybackState state;
+        long duration = -1;
         synchronized (mLock) {
             state = mPlaybackState;
-        }
-        long duration = -1;
-        if (mMetadata != null && mMetadata.containsKey(MediaMetadata.METADATA_KEY_DURATION)) {
-            duration = mMetadata.getLong(MediaMetadata.METADATA_KEY_DURATION);
+            if (mMetadata != null && mMetadata.containsKey(MediaMetadata.METADATA_KEY_DURATION)) {
+                duration = mMetadata.getLong(MediaMetadata.METADATA_KEY_DURATION);
+            }
         }
         PlaybackState result = null;
         if (state != null) {
@@ -725,10 +725,14 @@ public class MediaSessionRecord implements IBinder.DeathRecipient {
 
         @Override
         public void setMetadata(MediaMetadata metadata) {
-            // Make a copy of the metadata as the underlying bundle may be
-            // modified on this thread.
             synchronized (mLock) {
-                mMetadata = metadata == null ? null : new MediaMetadata.Builder(metadata).build();
+                MediaMetadata temp = metadata == null ? null : new MediaMetadata.Builder(metadata)
+                        .build();
+                // This is to guarantee that the underlying bundle is unparceled
+                // before we set it to prevent concurrent reads from throwing an
+                // exception
+                temp.size();
+                mMetadata = temp;
             }
             mHandler.post(MessageHandler.MSG_UPDATE_METADATA);
         }