commit 2019a5e7a585d932ab5b12d7b31da46ca4daa64e
author Lajos Molnar <lajos@google.com> Wed Sep 06 19:41:19 2017 -0700
committer Baligh Uddin <baligh@google.com> Wed Nov 08 14:27:29 2017 -0800
tree 54b411012fb5c847a8b8aa364fb49b88b3cbe4fe
parent 110b6731d3932b63591ba516257ed03ebe6c9e6b

OMXNodeInstance: use a lock around OMX::freeNode

This is to avoid a concurrent use after free if other OMX commands
are being executed before the node is marked as deleted.

Bug: 63666573
Change-Id: I7720dd900bfa252f8675e0c56191adbf52aa957e

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 00b3c7b..34ecb22 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -488,6 +488,9 @@
             LOG_ALWAYS_FATAL("unknown state %s(%#x).", asString(state), state);
             break;
     }
+
+    Mutex::Autolock _l(mLock);
+
     status_t err = mOwner->freeNode(this);
 
     mDispatcher.clear();