commit 271defe729a10db25b45759c8ccfb5abed24c647
author Lajos Molnar <lajos@google.com> Wed Sep 06 19:41:19 2017 -0700
committer Lajos Molnar <lajos@google.com> Thu Sep 07 23:44:57 2017 +0000
tree 520f0e306ac9e3667a22f4715211e1aaedd38651
parent 654bf4f8e9bfef5c974025ce296141587e35099f

OMXNodeInstance: use a lock around OMX::freeNode

This is to avoid a concurrent use after free if other OMX commands
are being executed before the node is marked as deleted.

Bug: 63666573
Change-Id: I7720dd900bfa252f8675e0c56191adbf52aa957e

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index db99ef2..0a3575d 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -486,6 +486,9 @@
             LOG_ALWAYS_FATAL("unknown state %s(%#x).", asString(state), state);
             break;
     }
+
+    Mutex::Autolock _l(mLock);
+
     status_t err = mOwner->freeNode(this);
 
     mDispatcher.clear();