diff options
| author | 2022-09-08 17:42:45 +0000 | |
|---|---|---|
| committer | 2022-09-08 19:42:38 +0000 | |
| commit | ce15b9fc8930edb034938afd972d1f2e3fd1974c (patch) | |
| tree | 45939b6b10fd498f0c7abc34ebec9ae4204fc400 /libs/ultrahdr/jpegencoderhelper.cpp | |
| parent | ec6c073aed281ce50cdd0f38b0f9f4e247109700 (diff) | |
libbinder: fix buffer free race
Well, so the race is:
- client sends a large transaction (buffer A)
- server processes result
- server sends reply (1)
- client gets reply
- client sends another large transaction (buffer B)
- transaction fails, not enough space
- server frees buffer A (2)
This CL moves (2) to happen before (1). We set the Parcel size
to 0, which has the effect of freeing data, before the destructor
runs.
Test: binderLibTest
Test: binderLibTest --gtest_filter="*Garg*" --gtest_repeat=1000 --gtest_break_on_failure
Fixes: 238777741
Change-Id: Ic223a98c55904bb3f77ca13729cdf24a992cef1e
Diffstat (limited to 'libs/ultrahdr/jpegencoderhelper.cpp')
0 files changed, 0 insertions, 0 deletions