diff options
| author | Fabien Sanglard <sanglardf@google.com> | 2016-11-08 15:31:32 -0800 |
|---|---|---|
| committer | mh0rst <mhorst@tzi.de> | 2017-01-13 11:47:31 +0100 |
| commit | 65166fe47da62447310b67303ab9db9e5820178c (patch) | |
| tree | 857b63dcda21fa24a5eabbc19b3534db3312a167 | |
| parent | b22bca465e55618a949d9cbdea665a1a3a831241 (diff) | |
| download | frameworks_native-65166fe47da62447310b67303ab9db9e5820178c.zip frameworks_native-65166fe47da62447310b67303ab9db9e5820178c.tar.gz frameworks_native-65166fe47da62447310b67303ab9db9e5820178c.tar.bz2 | |
Fix SF security vulnerability: 32660278
Because of lack of mutex lock when get mSidebandStream, if one thread
getSidebandStream, another thread setSidebandStream frequently, an UAF
will be triggered.
Bug: 32660278
Test: Marlin device with poc
Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45
(cherry picked from commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843)
(cherry picked from commit 675e212c8c6653825cc3352c603caf2e40b00f9f)
| -rw-r--r-- | libs/gui/BufferQueueConsumer.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp index 7504ed4..7aea4bb 100644 --- a/libs/gui/BufferQueueConsumer.cpp +++ b/libs/gui/BufferQueueConsumer.cpp @@ -572,6 +572,7 @@ status_t BufferQueueConsumer::setTransformHint(uint32_t hint) { } sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const { + Mutex::Autolock lock(mCore->mMutex); return mCore->mSidebandStream; } |