commit bd78085f08d5e342a1e0b02dde7a25832c2dd62e
author Mikhail Naganov <mnaganov@google.com> Fri Apr 16 18:54:28 2021 +0000
committer Mikhail Naganov <mnaganov@google.com> Fri Apr 16 18:57:14 2021 +0000
tree e5086251251e6516a175010340c102107fbd4cdc
parent c73a52277fabf4fdf18b650237ea23c660f3fb4d

audio HAL - fix UAFs

Bug: 185259758
Test: N/A
Change-Id: I5ec70b098a00746108e10ab39e966607d78c84ae
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
(cherry picked from commit a8ac7cf706be7a77589070ea7c62f8e1b94ce316)

audio/2.0/default/StreamIn.cpp

diff --git a/audio/2.0/default/StreamIn.cpp b/audio/2.0/default/StreamIn.cpp
index 9c933a9..fea9156 100644
--- a/audio/2.0/default/StreamIn.cpp
+++ b/audio/2.0/default/StreamIn.cpp
@@ -378,9 +378,9 @@
     }
 
     // Create and launch the thread.
-    auto tempReadThread = std::make_unique<ReadThread>(
-        &mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),
-        tempStatusMQ.get(), tempElfGroup.get());
+    sp<ReadThread> tempReadThread =
+            new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),
+                           tempStatusMQ.get(), tempElfGroup.get());
     if (!tempReadThread->init()) {
         ALOGW("failed to start reader thread: %s", strerror(-status));
         sendError(Result::INVALID_ARGUMENTS);
@@ -396,7 +396,7 @@
     mCommandMQ = std::move(tempCommandMQ);
     mDataMQ = std::move(tempDataMQ);
     mStatusMQ = std::move(tempStatusMQ);
-    mReadThread = tempReadThread.release();
+    mReadThread = tempReadThread;
     mEfGroup = tempElfGroup.release();
     threadInfo.pid = getpid();
     threadInfo.tid = mReadThread->getTid();

audio/2.0/default/StreamOut.cpp

diff --git a/audio/2.0/default/StreamOut.cpp b/audio/2.0/default/StreamOut.cpp
index 22dcd0c..b9eaea8 100644
--- a/audio/2.0/default/StreamOut.cpp
+++ b/audio/2.0/default/StreamOut.cpp
@@ -353,9 +353,9 @@
     }
 
     // Create and launch the thread.
-    auto tempWriteThread = std::make_unique<WriteThread>(
-        &mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),
-        tempStatusMQ.get(), tempElfGroup.get());
+    sp<WriteThread> tempWriteThread =
+            new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(), tempDataMQ.get(),
+                            tempStatusMQ.get(), tempElfGroup.get());
     if (!tempWriteThread->init()) {
         ALOGW("failed to start writer thread: %s", strerror(-status));
         sendError(Result::INVALID_ARGUMENTS);
@@ -371,7 +371,7 @@
     mCommandMQ = std::move(tempCommandMQ);
     mDataMQ = std::move(tempDataMQ);
     mStatusMQ = std::move(tempStatusMQ);
-    mWriteThread = tempWriteThread.release();
+    mWriteThread = tempWriteThread;
     mEfGroup = tempElfGroup.release();
     threadInfo.pid = getpid();
     threadInfo.tid = mWriteThread->getTid();