tree eb35fa80032254e24616d9caee838c004287512a
parent a0b4d0ce471cf10888bac4d4ec5b97fd562ad756
author Dave Platt <dplatt@google.com> 1393546580 -0800
committer Dave Platt <dplatt@google.com> 1393968302 -0800

Harden NsdManager against null-dereference crashes

Due to race conditions or programming errors, the NsdManager
can attempt to process an asynchronous status message (and issue
a callback to the listener) after the listener has already been
removed from the NsdManager state.  This causes dereferencing of
null objects, and a crash.

Split out the three async-queue message cases:  these are ones
in which message.arg2 does not hold an NsdManager array index
and the code should not interpret this field as if it were.

Add an explicit check for "null listener" (the array index in the
message has already been released), log a warning, and exit early.

Safeguard accesses to the "NSD service type" string from a (possibly
null) NsdServiceInfo object... return a constant "?" string rather
than crashing.

Bug: 9016259

Change-Id: I40aabdfc65d86fdd0eaac7a1e7e56e6ff69796cf