diff options
| author | Mikhail Naganov <mnaganov@google.com> | 2019-12-04 17:34:44 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2019-12-04 17:34:44 -0800 |
| commit | 78836599d293cd4abb56ee20f3cfdd0ce0061a02 (patch) | |
| tree | ba307e88adf070db8cd9949e70728beee73fdae2 /audio/effect/all-versions/default/Effect.cpp | |
| parent | 7216c1bb336531d69e8fec8a879480815db9e04b (diff) | |
| parent | 532240f4eb07e638e306d59fb666b4dd8c8bce71 (diff) | |
Audio HAL: Fix UAF if the effect is removed after close
am: 532240f4eb
Change-Id: I3a6ce3da68a1be76858f936d437860503b93c03b
Diffstat (limited to 'audio/effect/all-versions/default/Effect.cpp')
| -rw-r--r-- | audio/effect/all-versions/default/Effect.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp index 0afa779f03..33ec996d57 100644 --- a/audio/effect/all-versions/default/Effect.cpp +++ b/audio/effect/all-versions/default/Effect.cpp @@ -713,7 +713,10 @@ Return<Result> Effect::close() { #elif MAJOR_VERSION >= 6 // No need to join the processing thread, it is part of the API contract that the client // must finish processing before closing the effect. - return analyzeStatus("EffectRelease", "", sContextCallFunction, EffectRelease(mHandle)); + Result retval = + analyzeStatus("EffectRelease", "", sContextCallFunction, EffectRelease(mHandle)); + EffectMap::getInstance().remove(mHandle); + return retval; #endif } |