commit 922ab40347b71a2a65ff481a48cf379005f4f04d
author Fabien Sanglard <sanglardf@google.com> Tue Nov 08 15:35:02 2016 -0800
committer gitbuildkicker <android-build@google.com> Mon Dec 19 13:30:08 2016 -0800
tree 6456e31c8b573aa2293b953cbc5011b86a16d7c7
parent 7c1f9533844e68e03ac1f0c9b2850d68650880ba

Fix SF security vulnerability: 32706020

Because of lack of mutex lock when get mConsumerName, if one thread
getConsumerName, another thread setConsumerName frequently, an UAF will
be triggered.

Change-Id: Id1bbf0d15de6d16def2f54ecade385058cda3b65
Test: Marling with poc provided in bug report.
Bug: 32706020
(cherry picked from commit d073eb7a3f28fd74bfa24c8b7599465cb7de5436)

libs/gui/BufferQueueProducer.cpp

diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index 48b1db8..05923b5 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -1352,6 +1352,7 @@
 
 String8 BufferQueueProducer::getConsumerName() const {
     ATRACE_CALL();
+    Mutex::Autolock lock(mCore->mMutex);
     BQ_LOGV("getConsumerName: %s", mConsumerName.string());
     return mConsumerName;
 }