summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFabien Sanglard <sanglardf@google.com>2016-11-08 15:31:32 -0800
committermh0rst <mhorst@tzi.de>2017-01-13 11:47:31 +0100
commit65166fe47da62447310b67303ab9db9e5820178c (patch)
tree857b63dcda21fa24a5eabbc19b3534db3312a167
parentb22bca465e55618a949d9cbdea665a1a3a831241 (diff)
downloadframeworks_native-65166fe47da62447310b67303ab9db9e5820178c.zip
frameworks_native-65166fe47da62447310b67303ab9db9e5820178c.tar.gz
frameworks_native-65166fe47da62447310b67303ab9db9e5820178c.tar.bz2
Fix SF security vulnerability: 32660278
Because of lack of mutex lock when get mSidebandStream, if one thread getSidebandStream, another thread setSidebandStream frequently, an UAF will be triggered. Bug: 32660278 Test: Marlin device with poc Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45 (cherry picked from commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843) (cherry picked from commit 675e212c8c6653825cc3352c603caf2e40b00f9f)
-rw-r--r--libs/gui/BufferQueueConsumer.cpp1
1 files changed, 1 insertions, 0 deletions
diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index 7504ed4..7aea4bb 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -572,6 +572,7 @@ status_t BufferQueueConsumer::setTransformHint(uint32_t hint) {
}
sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const {
+ Mutex::Autolock lock(mCore->mMutex);
return mCore->mSidebandStream;
}