commit b35141c641f319ea0568fedcaab37eaacae84828
author Henry Fang <quxiangfang@google.com> Mon Jun 29 13:11:39 2020 -0700
committer Henry Fang <quxiangfang@google.com> Mon Jun 29 21:15:29 2020 +0000
tree 8b58d9d2b377d57a208e06d1b431c36c6e5140d6
parent 529e9da22e73a3bccf40e8e08809402395133688

Fix use after free issue

inside removeResource, it free this (DeathNotifier object)
overridePid after removeResource will cause use-after-free issue

bug: 152324474
Test: Manual
Change-Id: I353a3e6812dd3c0b4989aa7fdb28b17f83fb0816

services/mediaresourcemanager/ResourceManagerService.cpp

diff --git a/services/mediaresourcemanager/ResourceManagerService.cpp b/services/mediaresourcemanager/ResourceManagerService.cpp
index ff45c87..3d36f8e 100644
--- a/services/mediaresourcemanager/ResourceManagerService.cpp
+++ b/services/mediaresourcemanager/ResourceManagerService.cpp
@@ -57,9 +57,11 @@
         ALOGW("ResourceManagerService is dead as well.");
         return;
     }
-    service->removeResource(mPid, mClientId, false);
 
     service->overridePid(mPid, -1);
+    // thiz is freed in the call below, so it must be last call referring thiz
+    service->removeResource(mPid, mClientId, false);
+
 }
 
 template <typename T>