Fix race condition in IMediaSource
Bug: 148223229
Test: PoC
Change-Id: Iafe6ee6b4819765adb0bf46ece7605a23923e241
diff --git a/media/libmedia/IMediaSource.cpp b/media/libmedia/IMediaSource.cpp
index b18571f..36cd73b 100644
--- a/media/libmedia/IMediaSource.cpp
+++ b/media/libmedia/IMediaSource.cpp
@@ -107,7 +107,7 @@
data.writeInterfaceToken(BpMediaSource::getInterfaceDescriptor());
status_t ret = remote()->transact(GETFORMAT, data, &reply);
if (ret == NO_ERROR) {
- AutoMutex _l(mLock);
+ AutoMutex _l(mBpLock);
mMetaData = MetaData::createFromParcel(reply);
return mMetaData;
}
@@ -224,7 +224,7 @@
// XXX: could we use this for caching, or does metadata change on the fly?
sp<MetaData> mMetaData;
// ensure synchronize access to mMetaData
- Mutex mLock;
+ Mutex mBpLock;
// Cache all IMemory objects received from MediaExtractor.
// We gc IMemory objects that are no longer active (referenced by a MediaBuffer).
@@ -301,6 +301,7 @@
CHECK_INTERFACE(IMediaSource, data, reply);
mGroup->signalBufferReturned(nullptr);
status_t status = stop();
+ AutoMutex _l(mBnLock);
mIndexCache.reset();
mBuffersSinceStop = 0;
return status;
@@ -340,6 +341,7 @@
&& len == sizeof(opts)
&& data.read((void *)&opts, len) == NO_ERROR;
+ AutoMutex _l(mBnLock);
mGroup->signalBufferReturned(nullptr);
mIndexCache.gc();
size_t inlineTransferSize = 0;
diff --git a/media/libmedia/include/media/IMediaSource.h b/media/libmedia/include/media/IMediaSource.h
index f3fa39b..84310f0 100644
--- a/media/libmedia/include/media/IMediaSource.h
+++ b/media/libmedia/include/media/IMediaSource.h
@@ -135,6 +135,7 @@
private:
uint32_t mBuffersSinceStop; // Buffer tracking variable
+ Mutex mBnLock; // to guard readMultiple against concurrent access to the buffer cache
std::unique_ptr<MediaBufferGroup> mGroup;