Merge "libbinder: scope down Parcel data in RPC transact" am: 659917d399 am: e49545875d am: 3b3c0bd412

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/1676154

Change-Id: I7e8b3a7526a22967b8f38386c8ab22afad0588c8

1 files changed, 10 insertions, 9 deletions

diff --git a/libs/binder/RpcState.cpp b/libs/binder/RpcState.cpp
index 755ff35781..9d597f92db 100644
--- a/libs/binder/RpcState.cpp
+++ b/libs/binder/RpcState.cpp
@@ -498,19 +498,20 @@ status_t RpcState::processTransactInternal(const base::unique_fd& fd,
         }
     }
 
-    Parcel data;
-    // transaction->data is owned by this function. Parcel borrows this data and
-    // only holds onto it for the duration of this function call. Parcel will be
-    // deleted before the 'transactionData' object.
-    data.ipcSetDataReference(transaction->data,
-                             transactionData.size() - offsetof(RpcWireTransaction, data),
-                             nullptr /*object*/, 0 /*objectCount*/, do_nothing_to_transact_data);
-    data.markForRpc(connection);
-
     Parcel reply;
     reply.markForRpc(connection);
 
     if (replyStatus == OK) {
+        Parcel data;
+        // transaction->data is owned by this function. Parcel borrows this data and
+        // only holds onto it for the duration of this function call. Parcel will be
+        // deleted before the 'transactionData' object.
+        data.ipcSetDataReference(transaction->data,
+                                 transactionData.size() - offsetof(RpcWireTransaction, data),
+                                 nullptr /*object*/, 0 /*objectCount*/,
+                                 do_nothing_to_transact_data);
+        data.markForRpc(connection);
+
         if (target) {
             replyStatus = target->transact(transaction->code, data, &reply, transaction->flags);
         } else {