tag c2458bb31e557f8da7d06c307fec8c7aa2e6bb8e
tagger The Android Open Source Project <initial-contribution@android.com> Mon Jan 04 14:57:59 2021 -0800
object 7cb5b48ba21764249928dc405cb5d7ac41c897cb

Android security 8.1.0 release 84

commit 7cb5b48ba21764249928dc405cb5d7ac41c897cb
author Arthur Ishiguro <arthuri@google.com> Tue Sep 22 13:05:15 2020 -0700
committer Anis Assi <anisassi@google.com> Thu Nov 12 11:44:46 2020 -0800
tree aa4aa98af885c49e41eb99785d2835cd641e805d
parent 5dd8c54fe37a50f4cbf2769176509e90ef42ddf0

Prevent mEventCache UAF in SensorEventConnection

Since there is no check to see if SensorEventConnection has been
destroyed, the mEventCache pointer can still be used even after it
was freed.

Bug: 168211968
Test: Run test code that attempts to enable a sensor after destroying
the SensorEventConnection, and verify no system_server crash occurs.

Change-Id: Ia9275b7cc574df371cdb2e1b80c6699df193b580
Merged-In: Ia9275b7cc574df371cdb2e1b80c6699df193b580
(cherry picked from commit 09052cc6655ab2756c4c484b958cdaf29325e652)