OMXNodeInstance: use a lock in freeNode This is to avoid a concurrent use after free if other OMX commands are being executed before the node is marked as deleted. Bug: 63666573 Change-Id: I7720dd900bfa252f8675e0c56191adbf52aa957e (cherry picked from commit 975fa5b8b6fcaffc7ade6ee4de56847b1839797c)
diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp index f3f53bd..85ff226 100644 --- a/media/libstagefright/omx/OMXNodeInstance.cpp +++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -353,6 +353,8 @@ break; } + Mutex::Autolock _l(mLock); + ALOGV("[%x:%s] calling destroyComponentInstance", mNodeID, mName); OMX_ERRORTYPE err = master->destroyComponentInstance( static_cast<OMX_COMPONENTTYPE *>(mHandle));