From e223f08addb622d3645bb005172e493094a6baa8 Mon Sep 17 00:00:00 2001
From: Jon Spivack <spivack@google.com>
Date: Tue, 19 Nov 2019 16:21:20 -0800
Subject: Fix iterator in ServiceManager::removeCallback

The pointer to the iterator in this function wasn't properly dereferenced, leading to an inifinite loop in ServiceManager::binderDied.

Bug: 144534962
Test: Manual (boot and dynamically start services)
Change-Id: Ie7b8685b5de31ab7c9ba5877b6df3af08aab0c0f
---
 cmds/servicemanager/ServiceManager.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmds/servicemanager/ServiceManager.cpp b/cmds/servicemanager/ServiceManager.cpp
index 861401c979..adecc3c5b3 100644
--- a/cmds/servicemanager/ServiceManager.cpp
+++ b/cmds/servicemanager/ServiceManager.cpp
@@ -306,7 +306,7 @@ void ServiceManager::removeCallback(const wp<IBinder>& who,
     if (listeners.empty()) {
         *it = mNameToCallback.erase(*it);
     } else {
-        it++;
+        (*it)++;
     }
 }
 
-- 
cgit v1.2.3-59-g8ed1b