commit 52b94be22ca8b9832729cfc88f247c6e4b9f9218
author Hangyu Kuang <hkuang@google.com> Wed Feb 08 22:14:24 2017 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Wed Feb 08 22:14:24 2017 +0000
tree 4bf1d99d667049edbd1544fd50b04a683668500b
parent 9aa1dcbccba23378312e63bb0dd2cbe4ef4cb1f9
parent fc079f79d8d4f6ef9f138aa615486c10dda99fb7

Merge "media: Protect access to writer after free in stagefright recorder."

media/libmediaplayerservice/StagefrightRecorder.cpp

diff --git a/media/libmediaplayerservice/StagefrightRecorder.cpp b/media/libmediaplayerservice/StagefrightRecorder.cpp
index 9ce65c4..d00e377 100644
--- a/media/libmediaplayerservice/StagefrightRecorder.cpp
+++ b/media/libmediaplayerservice/StagefrightRecorder.cpp
@@ -275,6 +275,7 @@
 }
 
 status_t StagefrightRecorder::setNextOutputFile(int fd) {
+    Mutex::Autolock autolock(mLock);
     // Only support MPEG4
     if (mOutputFormat != OUTPUT_FORMAT_MPEG_4) {
         ALOGE("Only MP4 file format supports setting next output file");
@@ -290,6 +291,10 @@
     // start with a clean, empty file
     ftruncate(fd, 0);
     int nextFd = dup(fd);
+    if (mWriter == NULL) {
+        ALOGE("setNextOutputFile failed. Writer has been freed");
+        return INVALID_OPERATION;
+    }
     return mWriter->setNextFd(nextFd);
 }
 
@@ -851,6 +856,8 @@
 }
 
 status_t StagefrightRecorder::prepare() {
+    ALOGV("prepare");
+    Mutex::Autolock autolock(mLock);
     if (mVideoSource == VIDEO_SOURCE_SURFACE) {
         return prepareInternal();
     }
@@ -859,6 +866,7 @@
 
 status_t StagefrightRecorder::start() {
     ALOGV("start");
+    Mutex::Autolock autolock(mLock);
     if (mOutputFd < 0) {
         ALOGE("Output file descriptor is invalid");
         return INVALID_OPERATION;
@@ -1867,6 +1875,7 @@
 
 status_t StagefrightRecorder::stop() {
     ALOGV("stop");
+    Mutex::Autolock autolock(mLock);
     status_t err = OK;
 
     if (mCaptureFpsEnable && mCameraSourceTimeLapse != NULL) {
@@ -1984,6 +1993,7 @@
 status_t StagefrightRecorder::dump(
         int fd, const Vector<String16>& args) const {
     ALOGV("dump");
+    Mutex::Autolock autolock(mLock);
     const size_t SIZE = 256;
     char buffer[SIZE];
     String8 result;

media/libmediaplayerservice/StagefrightRecorder.h

diff --git a/media/libmediaplayerservice/StagefrightRecorder.h b/media/libmediaplayerservice/StagefrightRecorder.h
index 870c5d0..b7d0b0e 100644
--- a/media/libmediaplayerservice/StagefrightRecorder.h
+++ b/media/libmediaplayerservice/StagefrightRecorder.h
@@ -43,7 +43,6 @@
 struct StagefrightRecorder : public MediaRecorderBase {
     explicit StagefrightRecorder(const String16 &opPackageName);
     virtual ~StagefrightRecorder();
-
     virtual status_t init();
     virtual status_t setAudioSource(audio_source_t as);
     virtual status_t setVideoSource(video_source vs);
@@ -73,6 +72,7 @@
     virtual sp<IGraphicBufferProducer> querySurfaceMediaSource() const;
 
 private:
+    mutable Mutex mLock;
     sp<hardware::ICamera> mCamera;
     sp<ICameraRecordingProxy> mCameraProxy;
     sp<IGraphicBufferProducer> mPreviewSurface;