commit ee0a0e39acdcf8f97e0d6945c31ff36a06a36e9d
author Robert Shih <robertshih@google.com> Tue Aug 16 16:50:54 2016 -0700
committer Robert Shih <robertshih@google.com> Tue Aug 16 17:13:47 2016 -0700
tree e2cd58cba0269f63036fbf85b2182f9f04771289
parent 8f4b1a7de0e102b9203cfda3970edd2eedd9becf

MediaPlayerService: avoid invalid static cast

Bug: 30204103
Change-Id: Ie0dd3568a375f1e9fed8615ad3d85184bcc99028

media/libmediaplayerservice/MediaPlayerService.cpp

diff --git a/media/libmediaplayerservice/MediaPlayerService.cpp b/media/libmediaplayerservice/MediaPlayerService.cpp
index fde317c..7c00717 100644
--- a/media/libmediaplayerservice/MediaPlayerService.cpp
+++ b/media/libmediaplayerservice/MediaPlayerService.cpp
@@ -572,6 +572,12 @@
     mClients.remove(client);
 }
 
+bool MediaPlayerService::hasClient(wp<Client> client)
+{
+    Mutex::Autolock lock(mLock);
+    return mClients.indexOf(client) != NAME_NOT_FOUND;
+}
+
 MediaPlayerService::Client::Client(
         const sp<MediaPlayerService>& service, pid_t pid,
         int32_t connId, const sp<IMediaPlayerClient>& client,
@@ -1008,6 +1014,10 @@
     ALOGV("setNextPlayer");
     Mutex::Autolock l(mLock);
     sp<Client> c = static_cast<Client*>(player.get());
+    if (!mService->hasClient(c)) {
+      return BAD_VALUE;
+    }
+
     mNextClient = c;
 
     if (c != NULL) {

media/libmediaplayerservice/MediaPlayerService.h

diff --git a/media/libmediaplayerservice/MediaPlayerService.h b/media/libmediaplayerservice/MediaPlayerService.h
index 3b96e88..9ef2180 100644
--- a/media/libmediaplayerservice/MediaPlayerService.h
+++ b/media/libmediaplayerservice/MediaPlayerService.h
@@ -287,6 +287,7 @@
     virtual status_t            dump(int fd, const Vector<String16>& args);
 
             void                removeClient(wp<Client> client);
+            bool                hasClient(wp<Client> client);
 
     // For battery usage tracking purpose
     struct BatteryUsageInfo {