commit 2cadb587e050198f8dd585f073400ae81f3a28f0
author Eric Laurent <elaurent@google.com> Fri Nov 02 15:06:38 2018 -0700
committer Eric Laurent <elaurent@google.com> Mon Jul 01 11:55:52 2019 -0700
tree 01bfc851e7b7b1caca8e0d408603e6268f26b2f6
parent 7f943041efea40a7c4a7335ed6f5db23a450c565

remote submix: add null check on audio pipe pointer

In remote submix audio HAL, Add null check on Pipe sink pointer
in out_get_presentation_position() and out_get_render_position().

Bug: 117183072
Test: manual test with capture from BLE remote mic.
Change-Id: I05aa87f414c69bcd08c7692918e6a215077b7ea2

modules/audio_remote_submix/audio_hw.cpp

diff --git a/modules/audio_remote_submix/audio_hw.cpp b/modules/audio_remote_submix/audio_hw.cpp
index 833c12b..8e80170 100644
--- a/modules/audio_remote_submix/audio_hw.cpp
+++ b/modules/audio_remote_submix/audio_hw.cpp
@@ -823,6 +823,7 @@
     // from the pipe to make space to write the most recent data.
     {
         const size_t availableToWrite = sink->availableToWrite();
+        // NOTE: rsxSink has been checked above and sink and source life cycles are synchronized
         sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
         if (rsxadev->routes[out->route_handle].input == NULL && availableToWrite < frames) {
             static uint8_t flush_buffer[64];
@@ -894,8 +895,14 @@
 
     int ret = -EWOULDBLOCK;
     pthread_mutex_lock(&rsxadev->lock);
-    const ssize_t frames_in_pipe =
-            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
+    if (source == NULL) {
+        ALOGW("%s called on released output", __FUNCTION__);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -ENODEV;
+    }
+
+    const ssize_t frames_in_pipe = source->availableToRead();
     if (CC_UNLIKELY(frames_in_pipe < 0)) {
         *frames = out->frames_written;
         ret = 0;
@@ -928,8 +935,14 @@
     struct submix_audio_device * const rsxadev = out->dev;
 
     pthread_mutex_lock(&rsxadev->lock);
-    const ssize_t frames_in_pipe =
-            rsxadev->routes[out->route_handle].rsxSource->availableToRead();
+    sp<MonoPipeReader> source = rsxadev->routes[out->route_handle].rsxSource;
+    if (source == NULL) {
+        ALOGW("%s called on released output", __FUNCTION__);
+        pthread_mutex_unlock(&rsxadev->lock);
+        return -ENODEV;
+    }
+
+    const ssize_t frames_in_pipe = source->availableToRead();
     if (CC_UNLIKELY(frames_in_pipe < 0)) {
         *dsp_frames = (uint32_t)out->frames_written_since_standby;
     } else {