summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFabien Sanglard <sanglardf@google.com>2016-11-08 15:35:02 -0800
committerBrinly Taylor <brinly@brinly.me>2017-03-13 04:56:11 +0000
commitc2983e9d3bc3905d06a8b7dfa58548687c50634a (patch)
tree0f780a3127e5663100e75dd5acf3d30db295eb54
parent0ff545d4a7ab8ceb76a0e90c11cf83adebe8b140 (diff)
downloadframeworks_native-c2983e9d3bc3905d06a8b7dfa58548687c50634a.zip
frameworks_native-c2983e9d3bc3905d06a8b7dfa58548687c50634a.tar.gz
frameworks_native-c2983e9d3bc3905d06a8b7dfa58548687c50634a.tar.bz2
Fix SF security vulnerability: 32706020
Because of lack of mutex lock when get mConsumerName, if one thread getConsumerName, another thread setConsumerName frequently, an UAF will be triggered. Change-Id: Id1bbf0d15de6d16def2f54ecade385058cda3b65 Test: Marling with poc provided in bug report. Bug: 32706020 (cherry picked from commit d073eb7a3f28fd74bfa24c8b7599465cb7de5436) (cherry picked from commit 2e16d5fac149dab3c3e8f1b2ca89f45cf55a7b34)
-rw-r--r--libs/gui/BufferQueueProducer.cpp1
1 files changed, 1 insertions, 0 deletions
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index a941e2d..5db0b37 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -1091,6 +1091,7 @@ status_t BufferQueueProducer::setGenerationNumber(uint32_t generationNumber) {
String8 BufferQueueProducer::getConsumerName() const {
ATRACE_CALL();
+ Mutex::Autolock lock(mCore->mMutex);
BQ_LOGV("getConsumerName: %s", mConsumerName.string());
return mConsumerName;
}