)]}' { "commit": "4470a2ffef6ed8438a2611193894da9f4d79b1be", "tree": "539d6b3d910a73c5e3ac7e02826b95df5ade17e8", "parents": [ "76923a32ab6ea25115b65ff86ade7235ba7b3a33" ], "author": { "name": "Arthur Ishiguro", "email": "arthuri@google.com", "time": "Tue Sep 22 13:05:15 2020 -0700" }, "committer": { "name": "Anis Assi", "email": "anisassi@google.com", "time": "Thu Nov 12 11:46:04 2020 -0800" }, "message": "Prevent mEventCache UAF in SensorEventConnection\n\nSince there is no check to see if SensorEventConnection has been\ndestroyed, the mEventCache pointer can still be used even after it\nwas freed.\n\nBug: 168211968\nTest: Run test code that attempts to enable a sensor after destroying\nthe SensorEventConnection, and verify no system_server crash occurs.\n\nChange-Id: Ia9275b7cc574df371cdb2e1b80c6699df193b580\nMerged-In: Ia9275b7cc574df371cdb2e1b80c6699df193b580\n(cherry picked from commit 3b27b3b3bb36274171a9abb31f3e3f6b53036cf0)\n", "tree_diff": [ { "type": "modify", "old_id": "956844f426971df602bba3503fed2ca322f22acb", "old_mode": 33188, "old_path": "services/sensorservice/SensorEventConnection.cpp", "new_id": "a9e8321dcfeaa06c05774cebbf10e1aab9667a64", "new_mode": 33188, "new_path": "services/sensorservice/SensorEventConnection.cpp" }, { "type": "modify", "old_id": "032721ea39f1b4fd0cae7331357e18128b9aff03", "old_mode": 33188, "old_path": "services/sensorservice/SensorEventConnection.h", "new_id": "84b4d86879d71f7d31a40741d98727e5ff5de99c", "new_mode": 33188, "new_path": "services/sensorservice/SensorEventConnection.h" } ] }