commit 9e1e25dd418773ad5e574441962dcc771d3ec2a3
author Eric Laurent <elaurent@google.com> Mon Oct 14 18:47:34 2019 -0700
committer jiabin <jiabin@google.com> Thu Dec 05 12:57:39 2019 -0800
tree a5733110e72d8e41d70a3b819458e2ceaa50f890
parent 74cfcdf8237a455f8b8ec8e1b2a08fe777cf7512

media utils: fix UAF in TimeCheckThread

Read log tag from request list under lock
to avoid use after free.

Bug: 142142406
Test: make
Change-Id: If4adab8c15a319dc84b7003adf3ac59a3980f075
Merged-In: If4adab8c15a319dc84b7003adf3ac59a3980f075

media/utils/TimeCheck.cpp

diff --git a/media/utils/TimeCheck.cpp b/media/utils/TimeCheck.cpp
index 265a232..96f7802 100644
--- a/media/utils/TimeCheck.cpp
+++ b/media/utils/TimeCheck.cpp
@@ -82,10 +82,10 @@
         if (waitTimeNs > 0) {
             status = mCond.waitRelative(mMutex, waitTimeNs);
         }
-    }
-    if (status != NO_ERROR) {
-        LOG_EVENT_STRING(LOGTAG_AUDIO_BINDER_TIMEOUT, tag);
-        LOG_ALWAYS_FATAL("TimeCheck timeout for %s", tag);
+        if (status != NO_ERROR) {
+            LOG_EVENT_STRING(LOGTAG_AUDIO_BINDER_TIMEOUT, tag);
+            LOG_ALWAYS_FATAL("TimeCheck timeout for %s", tag);
+        }
     }
     return true;
 }