commit 5841db78dff14898538200287d246577b1fc37e2
author Eric Laurent <elaurent@google.com> Wed Sep 09 05:16:08 2009 -0700
committer Eric Laurent <elaurent@google.com> Wed Sep 09 05:16:08 2009 -0700
tree 3d3cd806d443584a23a4ac3b3731ca3ba761c58e
parent 85fa14d35468acca07ce0085d67b909f673fae07

Fix issue 2107584: media server crash when AudioFlinger fails to allocate memory for track control block.

AudioFlinger: verify that mCblk is not null before using it in Track and RecordTrack contructors.
IAudioFlinger: check result of remote transaction before reading IAudioTrack and IAudioRecord.
IAudioTrack and IAudioRecord: check result of remote transaction before reading IMemory.

media/libmedia/IAudioFlinger.cpp

diff --git a/media/libmedia/IAudioFlinger.cpp b/media/libmedia/IAudioFlinger.cpp
index fc39a46..5089157 100644
--- a/media/libmedia/IAudioFlinger.cpp
+++ b/media/libmedia/IAudioFlinger.cpp
@@ -83,6 +83,7 @@
                                 status_t *status)
     {
         Parcel data, reply;
+        sp<IAudioTrack> track;
         data.writeInterfaceToken(IAudioFlinger::getInterfaceDescriptor());
         data.writeInt32(pid);
         data.writeInt32(streamType);
@@ -96,12 +97,14 @@
         status_t lStatus = remote()->transact(CREATE_TRACK, data, &reply);
         if (lStatus != NO_ERROR) {
             LOGE("createTrack error: %s", strerror(-lStatus));
+        } else {
+            lStatus = reply.readInt32();
+            track = interface_cast<IAudioTrack>(reply.readStrongBinder());
         }
-        lStatus = reply.readInt32();
         if (status) {
             *status = lStatus;
         }
-        return interface_cast<IAudioTrack>(reply.readStrongBinder());
+        return track;
     }
 
     virtual sp<IAudioRecord> openRecord(
@@ -115,6 +118,7 @@
                                 status_t *status)
     {
         Parcel data, reply;
+        sp<IAudioRecord> record;
         data.writeInterfaceToken(IAudioFlinger::getInterfaceDescriptor());
         data.writeInt32(pid);
         data.writeInt32(input);
@@ -123,12 +127,17 @@
         data.writeInt32(channelCount);
         data.writeInt32(frameCount);
         data.writeInt32(flags);
-        remote()->transact(OPEN_RECORD, data, &reply);
-        status_t lStatus = reply.readInt32();
+        status_t lStatus = remote()->transact(OPEN_RECORD, data, &reply);
+        if (lStatus != NO_ERROR) {
+            LOGE("openRecord error: %s", strerror(-lStatus));
+        } else {
+            lStatus = reply.readInt32();
+            record = interface_cast<IAudioRecord>(reply.readStrongBinder());
+        }
         if (status) {
             *status = lStatus;
         }
-        return interface_cast<IAudioRecord>(reply.readStrongBinder());
+        return record;
     }
 
     virtual uint32_t sampleRate(int output) const