commit 5faedf568d57786800072f6f0163fe652243208c
author Vishnu Nair <vishnun@google.com> Mon Mar 22 11:32:58 2021 -0700
committer Vishnu Nair <vishnun@google.com> Mon Mar 22 11:32:58 2021 -0700
tree 4d6adf7bc5ccff339480889bf7c07e98e71d9701
parent b05e90288e6e0179bd06c33bd9cadc349eb2879b

Fix releaseBufferCallback null pointer dereference

Test: atest ReleaseBufferCallbackTest
Fixes: 183206609
Change-Id: I2745934ca9c22afde07dd5be2f14bb59e7d4c930

libs/gui/SurfaceComposerClient.cpp

diff --git a/libs/gui/SurfaceComposerClient.cpp b/libs/gui/SurfaceComposerClient.cpp
index 7dc5e85..e6b74d0 100644
--- a/libs/gui/SurfaceComposerClient.cpp
+++ b/libs/gui/SurfaceComposerClient.cpp
@@ -292,8 +292,11 @@
                 // callback and a release buffer callback happening at the same time to avoid an
                 // additional ipc call from the server.
                 if (surfaceStats.previousBufferId) {
-                    ReleaseBufferCallback callback =
-                            popReleaseBufferCallbackLocked(surfaceStats.previousBufferId);
+                    ReleaseBufferCallback callback;
+                    {
+                        std::scoped_lock<std::mutex> lock(mMutex);
+                        callback = popReleaseBufferCallbackLocked(surfaceStats.previousBufferId);
+                    }
                     if (callback) {
                         callback(surfaceStats.previousBufferId,
                                  surfaceStats.previousReleaseFence