commit 8437d9f623150ee61a5af8d4871e1e1fde98e89e
author Jiyong Park <jiyong@google.com> Wed Nov 21 19:00:33 2018 +0900
committer Jiyong Park <jiyong@google.com> Thu Nov 22 13:08:52 2018 +0900
tree 6d06ced956c52a31d5e04401ad3b4ac8b28375e1
parent f25cf0661e943e5d80c57d7dbfb61a733a535108

Fix double-freeing of ScopedAResource

Default move constructor didn't reset mT to nullptr, which caused double
freeing of mT when returning ScopedAResource without NRVO. Fixing the
bug by resetting mT to its default value.

Test: atest under cts/tests/tests/binder_ndk
Change-Id: I04c874f802d8f88fa5f495776c00f7e2f74db094

libs/binder/ndk/include_ndk/android/binder_auto_utils.h

diff --git a/libs/binder/ndk/include_ndk/android/binder_auto_utils.h b/libs/binder/ndk/include_ndk/android/binder_auto_utils.h
index e2c0cfa..c6fcaa4 100644
--- a/libs/binder/ndk/include_ndk/android/binder_auto_utils.h
+++ b/libs/binder/ndk/include_ndk/android/binder_auto_utils.h
@@ -163,7 +163,9 @@
     ScopedAResource& operator=(ScopedAResource&&) = delete;
 
     // move-constructing is okay
-    ScopedAResource(ScopedAResource&&) = default;
+    ScopedAResource(ScopedAResource&& other) : mT(std::move(other.mT)) {
+      other.mT = DEFAULT;
+    }
 
    private:
     T mT;