commit 5096385d0e5c102a7297d53aeb693402f304f5af
author Pawin Vongmasa <pawin@google.com> Tue Dec 12 06:24:42 2017 -0800
committer Pawin Vongmasa <pawin@google.com> Wed Dec 13 04:29:40 2017 -0800
tree 329fa6face6b4bba3c719ac84b5077bd6c2a01f0
parent 2eee2bf902e9dd3aeaa8dbfed3cdeddc19100878

Make a separate MediaPlayer2Base::NotifyCallback

This avoids the collision with notify_callback_f.

Also, this CL should fix the potential use-after-free in notify().

Test: Builds properly
Bug: 70546581
Change-Id: Ia4919522d00c94591d6f14a27cb6465a8c4efaeb

media/libmedia/MediaPlayer2Manager.cpp

diff --git a/media/libmedia/MediaPlayer2Manager.cpp b/media/libmedia/MediaPlayer2Manager.cpp
index 9b7f98a..637214e 100644
--- a/media/libmedia/MediaPlayer2Manager.cpp
+++ b/media/libmedia/MediaPlayer2Manager.cpp
@@ -1258,12 +1258,13 @@
 }
 
 void MediaPlayer2Manager::Client::notify(
-        void* cookie, int msg, int ext1, int ext2, const Parcel *obj)
+        const wp<MediaPlayer2Engine> &listener, int msg, int ext1, int ext2, const Parcel *obj)
 {
-    Client* client = static_cast<Client*>(cookie);
-    if (client == NULL) {
+    sp<MediaPlayer2Engine> spListener = listener.promote();
+    if (spListener == NULL) {
         return;
     }
+    Client* client = static_cast<Client*>(spListener.get());
 
     sp<MediaPlayer2EngineClient> c;
     sp<Client> nextClient;
@@ -1311,7 +1312,7 @@
     }
 
     if (c != NULL) {
-        ALOGV("[%d] notify (%p, %d, %d, %d)", client->mConnId, cookie, msg, ext1, ext2);
+        ALOGV("[%d] notify (%p, %d, %d, %d)", client->mConnId, spListener.get(), msg, ext1, ext2);
         c->notify(msg, ext1, ext2, obj);
     }
 }
@@ -1405,7 +1406,9 @@
 #if CALLBACK_ANTAGONIZER
 const int Antagonizer::interval = 10000; // 10 msecs
 
-Antagonizer::Antagonizer(notify_callback_f cb, void* client) :
+Antagonizer::Antagonizer(
+        MediaPlayer2Manager::NotifyCallback cb,
+        const wp<MediaPlayer2Engine> &client) :
     mExit(false), mActive(false), mClient(client), mCb(cb)
 {
     createThread(callbackThread, this);