commit c7fe16530e1ab27a1298114925334e1c46ebd36f
author Pawin Vongmasa <pawin@google.com> Tue Dec 12 01:56:40 2017 -0800
committer Pawin Vongmasa <pawin@google.com> Sun Dec 17 19:35:41 2017 -0800
tree 4fc543bab09ec64e07b9f659cf78d252e67ac970
parent f394af84d6f9509800ed81b123f5810e2dd4168d

RESTRICT AUTOMERGE Prevent MediaPlayerService::Client's use-after-free

Test: make cts -j123 && cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice

Bug: 70546581
Merged-In: Ia3a8eb99c2faf6935c63800ba08f65970cede48e
Change-Id: Ia142a7735c6685eb67b2c00917c0ed5ea7e0da9e

media/libmediaplayerservice/MediaPlayerFactory.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerFactory.cpp b/media/libmediaplayerservice/MediaPlayerFactory.cpp
index 605c710..f5ec20c 100644
--- a/media/libmediaplayerservice/MediaPlayerFactory.cpp
+++ b/media/libmediaplayerservice/MediaPlayerFactory.cpp
@@ -127,8 +127,7 @@
 
 sp<MediaPlayerBase> MediaPlayerFactory::createPlayer(
         player_type playerType,
-        void* cookie,
-        notify_callback_f notifyFunc,
+        const sp<MediaPlayerBase::Listener> &listener,
         pid_t pid) {
     sp<MediaPlayerBase> p;
     IFactory* factory;
@@ -153,7 +152,7 @@
 
     init_result = p->initCheck();
     if (init_result == NO_ERROR) {
-        p->setNotifyCallback(cookie, notifyFunc);
+        p->setNotifyCallback(listener);
     } else {
         ALOGE("Failed to create player object of type %d, initCheck failed"
               " (res = %d)", playerType, init_result);