commit b6686e725a5a06757d66898562f20d5ea04ea9b3
author Yu-Han Yang <yuhany@google.com> Wed Apr 13 12:40:52 2022 -0700
committer Yu-Han Yang <yuhany@google.com> Wed Apr 13 17:06:26 2022 -0700
tree 3c96b0480a7caf62377a01698e039f2d5cd538e4
parent 3c25334fccbfea52781152d0a6bc0a0335d66a37

Fix use-after-free in GnssMesaurementInterface

Bug: 228639296
Test: on Cuttlefish
Change-Id: Ibd36d23f2059ae994132099dd67d8fd10f84cd72

gnss/aidl/default/Gnss.cpp

diff --git a/gnss/aidl/default/Gnss.cpp b/gnss/aidl/default/Gnss.cpp
index 7855b51..226b1f4 100644
--- a/gnss/aidl/default/Gnss.cpp
+++ b/gnss/aidl/default/Gnss.cpp
@@ -153,7 +153,6 @@
 
 std::vector<GnssSvInfo> Gnss::filterBlocklistedSatellites(
         std::vector<GnssSvInfo> gnssSvInfoList) const {
-    ALOGD("filterBlocklistedSatellites");
     for (uint32_t i = 0; i < gnssSvInfoList.size(); i++) {
         if (mGnssConfiguration->isBlocklisted(gnssSvInfoList[i])) {
             gnssSvInfoList[i].svFlag &= ~(uint32_t)IGnssCallback::GnssSvFlags::USED_IN_FIX;

gnss/aidl/default/GnssMeasurementInterface.cpp

diff --git a/gnss/aidl/default/GnssMeasurementInterface.cpp b/gnss/aidl/default/GnssMeasurementInterface.cpp
index 2c7241b..228d5bf 100644
--- a/gnss/aidl/default/GnssMeasurementInterface.cpp
+++ b/gnss/aidl/default/GnssMeasurementInterface.cpp
@@ -106,12 +106,14 @@
             std::this_thread::sleep_for(std::chrono::milliseconds(mMinIntervalMillis));
         }
     });
-    mThread.detach();
 }
 
 void GnssMeasurementInterface::stop() {
     ALOGD("stop");
     mIsActive = false;
+    if (mThread.joinable()) {
+        mThread.join();
+    }
 }
 
 void GnssMeasurementInterface::reportMeasurement(const GnssData& data) {

gnss/aidl/default/GnssNavigationMessageInterface.cpp

diff --git a/gnss/aidl/default/GnssNavigationMessageInterface.cpp b/gnss/aidl/default/GnssNavigationMessageInterface.cpp
index 4bc859d..fe34787 100644
--- a/gnss/aidl/default/GnssNavigationMessageInterface.cpp
+++ b/gnss/aidl/default/GnssNavigationMessageInterface.cpp
@@ -69,12 +69,14 @@
             std::this_thread::sleep_for(std::chrono::milliseconds(mMinIntervalMillis));
         }
     });
-    mThread.detach();
 }
 
 void GnssNavigationMessageInterface::stop() {
     ALOGD("stop");
     mIsActive = false;
+    if (mThread.joinable()) {
+        mThread.join();
+    }
 }
 
 void GnssNavigationMessageInterface::reportMessage(const GnssNavigationMessage& message) {