commit e274868d357cda94875476e1a4ec68fa34760113
author Lajos Molnar <lajos@google.com> Thu Sep 07 16:37:39 2017 -0700
committer JP Sugarbroad <jpsugar@google.com> Thu Oct 19 13:01:12 2017 -0700
tree caf01358ca55ddb52405b7dacffb4f30eef984b3
parent 2dce7a6a0e05fad91fef674c466a832a79bc1235

OMXNodeInstance: use a lock in freeNode

This is to avoid a concurrent use after free if other OMX commands
are being executed before the node is marked as deleted.

Bug: 63666573
Change-Id: I7720dd900bfa252f8675e0c56191adbf52aa957e
(cherry picked from commit 975fa5b8b6fcaffc7ade6ee4de56847b1839797c)

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index f6e8d60..7bd66b1 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -353,6 +353,8 @@
             break;
     }
 
+    Mutex::Autolock _l(mLock);
+
     ALOGV("[%x:%s] calling destroyComponentInstance", mNodeID, mName);
     OMX_ERRORTYPE err = master->destroyComponentInstance(
             static_cast<OMX_COMPONENTTYPE *>(mHandle));