summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFabien Sanglard <sanglardf@google.com>2016-11-08 15:31:32 -0800
committergitbuildkicker <android-build@google.com>2017-01-03 15:08:41 -0800
commit38ac668e47f80b513cab10bab6af585d810f59c3 (patch)
tree8674c79c320ce5ef342b9e4b165724de394e887c
parent9a8df9a20a808d336cd3334014d08cb3daefccfe (diff)
downloadandroid-frameworks-native-38ac668e47f80b513cab10bab6af585d810f59c3.tar.gz
android-frameworks-native-38ac668e47f80b513cab10bab6af585d810f59c3.tar.xz
Fix SF security vulnerability: 32660278android-7.1.1_r13
Because of lack of mutex lock when get mSidebandStream, if one thread getSidebandStream, another thread setSidebandStream frequently, an UAF will be triggered. Bug: 32660278 Test: Marlin device with poc Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45 (cherry picked from commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843)
-rw-r--r--libs/gui/BufferQueueConsumer.cpp1
1 files changed, 1 insertions, 0 deletions
diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index ca2a374..73d2042 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -715,6 +715,7 @@ status_t BufferQueueConsumer::setTransformHint(uint32_t hint) {
}
sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const {
+ Mutex::Autolock lock(mCore->mMutex);
return mCore->mSidebandStream;
}