summaryrefslogtreecommitdiffstats
path: root/libs
diff options
context:
space:
mode:
authorJessica Wagantall <jwagantall@cyngn.com>2016-05-03 11:38:50 -0700
committerJessica Wagantall <jwagantall@cyngn.com>2016-05-03 11:59:50 -0700
commit134fddb97d5fb257d57db438ca64f0692e794876 (patch)
tree8ea8e48e56bc9a826514d05f3cab9ea935e1dfa4 /libs
parent3ce4ffc46e31f4dd7ca89da1af0c40086f51a01e (diff)
parenta59b827869a2ea04022dd225007f29af8d61837a (diff)
downloadframeworks_native-134fddb97d5fb257d57db438ca64f0692e794876.zip
frameworks_native-134fddb97d5fb257d57db438ca64f0692e794876.tar.gz
frameworks_native-134fddb97d5fb257d57db438ca64f0692e794876.tar.bz2
Merge tag 'android-6.0.1_r43' into HEAD
Ticket: CYNGNOS-2373 Android 6.0.1 release 43 (MOB30J) Change-Id: I1d6a9cc67ded5dd7d0ee1f17773e326ac0ae87ce
Diffstat (limited to 'libs')
-rw-r--r--libs/binder/IPCThreadState.cpp12
-rw-r--r--libs/gui/IGraphicBufferConsumer.cpp2
-rw-r--r--libs/gui/IGraphicBufferProducer.cpp1
3 files changed, 12 insertions, 3 deletions
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index ef88181..af18e11 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -1083,8 +1083,16 @@ status_t IPCThreadState::executeCommand(int32_t cmd)
<< reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;
}
if (tr.target.ptr) {
- sp<BBinder> b((BBinder*)tr.cookie);
- error = b->transact(tr.code, buffer, &reply, tr.flags);
+ // We only have a weak reference on the target object, so we must first try to
+ // safely acquire a strong reference before doing anything else with it.
+ if (reinterpret_cast<RefBase::weakref_type*>(
+ tr.target.ptr)->attemptIncStrong(this)) {
+ error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,
+ &reply, tr.flags);
+ reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);
+ } else {
+ error = UNKNOWN_TRANSACTION;
+ }
} else {
error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
diff --git a/libs/gui/IGraphicBufferConsumer.cpp b/libs/gui/IGraphicBufferConsumer.cpp
index c4660ba..7ae82e0 100644
--- a/libs/gui/IGraphicBufferConsumer.cpp
+++ b/libs/gui/IGraphicBufferConsumer.cpp
@@ -349,7 +349,7 @@ status_t BnGraphicBufferConsumer::onTransact(
}
case GET_RELEASED_BUFFERS: {
CHECK_INTERFACE(IGraphicBufferConsumer, data, reply);
- uint64_t slotMask;
+ uint64_t slotMask = 0;
status_t result = getReleasedBuffers(&slotMask);
reply->writeInt64(static_cast<int64_t>(slotMask));
reply->writeInt32(result);
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 1099c84..c3c6235 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -435,6 +435,7 @@ status_t BnGraphicBufferProducer::onTransact(
QueueBufferOutput* const output =
reinterpret_cast<QueueBufferOutput *>(
reply->writeInplace(sizeof(QueueBufferOutput)));
+ memset(output, 0, sizeof(QueueBufferOutput));
status_t res = connect(listener, api, producerControlledByApp, output);
reply->writeInt32(res);
return NO_ERROR;