commit 028cf0973f928503e89124c3f6493a5226826ed9
author Pawin Vongmasa <pawin@google.com> Tue Dec 12 01:56:40 2017 -0800
committer Pawin Vongmasa <pawin@google.com> Thu Dec 14 16:29:26 2017 +0000
tree d726b12d56f9b32a7fc29667c0be3c3e558cae7c
parent 97eb375c515ab9cf7ad8e23b678b32f279059139

Prevent MediaPlayerService::Client's use-after-free

Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 70546581
Merged-In: Ia142a7735c6685eb67b2c00917c0ed5ea7e0da9e
Change-Id: Ia142a7735c6685eb67b2c00917c0ed5ea7e0da9e
(cherry picked from commit d27ad6bae3215db0ed174f5f036339c9515fbba7)

media/libmediaplayerservice/MediaPlayerFactory.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerFactory.cpp b/media/libmediaplayerservice/MediaPlayerFactory.cpp
index 0a9f791..88064d9 100644
--- a/media/libmediaplayerservice/MediaPlayerFactory.cpp
+++ b/media/libmediaplayerservice/MediaPlayerFactory.cpp
@@ -126,7 +126,7 @@
 
 sp<MediaPlayerBase> MediaPlayerFactory::createPlayer(
         player_type playerType,
-        void* cookie,
+        const wp<IMediaPlayer> &client,
         notify_callback_f notifyFunc,
         pid_t pid) {
     sp<MediaPlayerBase> p;
@@ -152,7 +152,7 @@
 
     init_result = p->initCheck();
     if (init_result == NO_ERROR) {
-        p->setNotifyCallback(cookie, notifyFunc);
+        p->setNotifyCallback(client, notifyFunc);
     } else {
         ALOGE("Failed to create player object of type %d, initCheck failed"
               " (res = %d)", playerType, init_result);