commit 4fd690113021bf07da9f7133908f0e17d46c68a8
author Andy Hung <hunga@google.com> Fri Jul 14 16:57:01 2023 -0700
committer Andy Hung <hunga@google.com> Sat Jul 15 01:25:02 2023 +0000
tree b872e00a1e482184caa303aa5d914a9072248c53
parent 73d5ec40f1f36252cf5ecceca0d375a43e2d33f0

AudioFlinger: Do not dereference a nullptr for a reference

Dereferencing a nullptr for a reference is undefined behavior,
just happened to work before but failed
after commit 87c693cdbda8f9282130c608205bd9cbce141bbc landed.

Test: atest AudioPlaybackCaptureTest
Bug: 288339104
Bug: 289233517
Bug: 291284433
Change-Id: Iec1011a9f6dc9088c5254fd10ae27f526defd490

services/audioflinger/TrackBase.h

diff --git a/services/audioflinger/TrackBase.h b/services/audioflinger/TrackBase.h
index bd569e6..194a515 100644
--- a/services/audioflinger/TrackBase.h
+++ b/services/audioflinger/TrackBase.h
@@ -391,7 +391,7 @@
 {
 public:
                         PatchTrackBase(const sp<ClientProxy>& proxy,
-                                       const IAfThreadBase& thread,
+                                       IAfThreadBase* thread,
                                        const Timeout& timeout);
             void setPeerTimeout(std::chrono::nanoseconds timeout) final;
             void setPeerProxy(const sp<IAfPatchTrackBase>& proxy, bool holdReference) final {

services/audioflinger/Tracks.cpp

diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index 6cb3d34..2a59315 100644
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -315,15 +315,15 @@
 }
 
 PatchTrackBase::PatchTrackBase(const sp<ClientProxy>& proxy,
-        const IAfThreadBase& thread, const Timeout& timeout)
+        IAfThreadBase* thread, const Timeout& timeout)
     : mProxy(proxy)
 {
     if (timeout) {
         setPeerTimeout(*timeout);
     } else {
         // Double buffer mixer
-        uint64_t mixBufferNs = ((uint64_t)2 * thread.frameCount() * 1000000000) /
-                                              thread.sampleRate();
+        uint64_t mixBufferNs = ((uint64_t)2 * thread->frameCount() * 1000000000) /
+                                              thread->sampleRate();
         setPeerTimeout(std::chrono::nanoseconds{mixBufferNs});
     }
 }
@@ -2451,7 +2451,7 @@
               TYPE_PATCH, AUDIO_PORT_HANDLE_NONE, frameCountToBeReady),
         PatchTrackBase(mCblk ? new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, true, true)
                         : nullptr,
-                       *playbackThread, timeout)
+                       playbackThread, timeout)
 {
     ALOGV("%s(%d): sampleRate %d mPeerTimeout %d.%03d sec",
                                       __func__, mId, sampleRate,
@@ -3125,7 +3125,7 @@
                 audioServerAttributionSource(getpid()), flags, TYPE_PATCH),
         PatchTrackBase(mCblk ? new ClientProxy(mCblk, mBuffer, frameCount, mFrameSize, false, true)
                         : nullptr,
-                       *recordThread, timeout)
+                       recordThread, timeout)
 {
     ALOGV("%s(%d): sampleRate %d mPeerTimeout %d.%03d sec",
                                       __func__, mId, sampleRate,