commit 301dd5f1d99993725cb6336e6d520904e23ce925
author Pawin Vongmasa <pawin@google.com> Tue Feb 04 00:40:33 2020 -0800
committer Pawin Vongmasa <pawin@google.com> Fri Mar 20 06:31:52 2020 +0000
tree a7a1db98c6513fafef31bd7e59139d95602ab257
parent ba8fee2a1d600f2610173fc248c6345d39f9a5da

OMXNodeInstance: Guard mActiveBuffers by mLock

Test: atest CtsMediaTestCases

Bug: 135003556
Bug: 142777721
Change-Id: I02b5c0be94a674fe21884d9faa0c0c9cfbedd5fc
Merged-In: I02b5c0be94a674fe21884d9faa0c0c9cfbedd5fc
(cherry picked from commit 0329492f9e2169ddba5b19f379ddc842db1efdb1)

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 2f69f45..5b2f6de 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -47,6 +47,8 @@
 
 #include <hidlmemory/mapping.h>
 
+#include <vector>
+
 static const OMX_U32 kPortIndexInput = 0;
 static const OMX_U32 kPortIndexOutput = 1;
 
@@ -493,9 +495,7 @@
 
         case OMX_StateLoaded:
         {
-            if (mActiveBuffers.size() > 0) {
-                freeActiveBuffers();
-            }
+            freeActiveBuffers();
             FALLTHROUGH_INTENDED;
         }
         case OMX_StateInvalid:
@@ -2430,11 +2430,19 @@
 }
 
 void OMXNodeInstance::freeActiveBuffers() {
-    // Make sure to count down here, as freeBuffer will in turn remove
-    // the active buffer from the vector...
-    for (size_t i = mActiveBuffers.size(); i > 0;) {
-        i--;
-        freeBuffer(mActiveBuffers[i].mPortIndex, mActiveBuffers[i].mID);
+    std::vector<OMX_U32> portIndices;
+    std::vector<IOMX::buffer_id> bufferIds;
+    {
+        // Access to mActiveBuffers must be protected by mLock.
+        Mutex::Autolock _l(mLock);
+        for (const ActiveBuffer& activeBuffer : mActiveBuffers) {
+            portIndices.emplace_back(activeBuffer.mPortIndex);
+            bufferIds.emplace_back(activeBuffer.mID);
+        }
+    }
+    for (size_t i = bufferIds.size(); i > 0; ) {
+        --i;
+        freeBuffer(portIndices[i], bufferIds[i]);
     }
 }