commit e8cd125e47d06f299465d183593bc99c1c424edb
author Wonsik Kim <wonsik@google.com> Wed Apr 17 01:15:35 2024 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Apr 17 01:15:35 2024 +0000
tree d6065e3060c3586d1bbd27f38cfe9c26ba33efbd
parent 20c9bba55bdcec5e4f14502d8016d2ba74a2c759
parent 0f56965eaa8f0838ae52e4e122429d8acd885be4

Merge "Fix MediaCodec potential use-after-free" into main

media/aconfig/codec_fwk.aconfig

diff --git a/media/aconfig/codec_fwk.aconfig b/media/aconfig/codec_fwk.aconfig
index a2b6a82..da422b5 100644
--- a/media/aconfig/codec_fwk.aconfig
+++ b/media/aconfig/codec_fwk.aconfig
@@ -13,6 +13,16 @@
 }
 
 flag {
+  name: "set_state_early"
+  namespace: "codec_fwk"
+  description: "Bugfix flag for setting state early to avoid a race condition"
+  bug: "298613712"
+  metadata {
+    purpose: PURPOSE_BUGFIX
+  }
+}
+
+flag {
   name: "dynamic_color_aspects"
   is_exported: true
   namespace: "codec_fwk"

media/libstagefright/MediaCodec.cpp

diff --git a/media/libstagefright/MediaCodec.cpp b/media/libstagefright/MediaCodec.cpp
index 19e51fd..4e378d4 100644
--- a/media/libstagefright/MediaCodec.cpp
+++ b/media/libstagefright/MediaCodec.cpp
@@ -6052,6 +6052,10 @@
         mErrorLog.clear();
     }
 
+    if (android::media::codec::provider_->set_state_early()) {
+        mState = newState;
+    }
+
     if (newState == UNINITIALIZED) {
         // return any straggling buffers, e.g. if we got here on an error
         returnBuffersToCodec();
@@ -6062,7 +6066,9 @@
         mFlags &= ~kFlagSawMediaServerDie;
     }
 
-    mState = newState;
+    if (!android::media::codec::provider_->set_state_early()) {
+        mState = newState;
+    }
 
     if (mBatteryChecker != nullptr) {
         mBatteryChecker->setExecuting(isExecuting());