Fix issue 2107584: media server crash when AudioFlinger fails to allocate memory for track control block.
AudioFlinger: verify that mCblk is not null before using it in Track and RecordTrack contructors.
IAudioFlinger: check result of remote transaction before reading IAudioTrack and IAudioRecord.
IAudioTrack and IAudioRecord: check result of remote transaction before reading IMemory.
diff --git a/libs/audioflinger/AudioFlinger.cpp b/libs/audioflinger/AudioFlinger.cpp
index e2b6b51..790a655 100644
--- a/libs/audioflinger/AudioFlinger.cpp
+++ b/libs/audioflinger/AudioFlinger.cpp
@@ -2014,6 +2014,7 @@
: RefBase(),
mThread(thread),
mClient(client),
+ mCblk(0),
mFrameCount(0),
mState(IDLE),
mClientTid(-1),
@@ -2162,21 +2163,23 @@
: TrackBase(thread, client, sampleRate, format, channelCount, frameCount, 0, sharedBuffer),
mMute(false), mSharedBuffer(sharedBuffer), mName(-1)
{
- sp<ThreadBase> baseThread = thread.promote();
- if (baseThread != 0) {
- PlaybackThread *playbackThread = (PlaybackThread *)baseThread.get();
- mName = playbackThread->getTrackName_l();
+ if (mCblk != NULL) {
+ sp<ThreadBase> baseThread = thread.promote();
+ if (baseThread != 0) {
+ PlaybackThread *playbackThread = (PlaybackThread *)baseThread.get();
+ mName = playbackThread->getTrackName_l();
+ }
+ LOGV("Track constructor name %d, calling thread %d", mName, IPCThreadState::self()->getCallingPid());
+ if (mName < 0) {
+ LOGE("no more track names available");
+ }
+ mVolume[0] = 1.0f;
+ mVolume[1] = 1.0f;
+ mStreamType = streamType;
+ // NOTE: audio_track_cblk_t::frameSize for 8 bit PCM data is based on a sample size of
+ // 16 bit because data is converted to 16 bit before being stored in buffer by AudioTrack
+ mCblk->frameSize = AudioSystem::isLinearPCM(format) ? channelCount * sizeof(int16_t) : sizeof(int8_t);
}
- LOGV("Track constructor name %d, calling thread %d", mName, IPCThreadState::self()->getCallingPid());
- if (mName < 0) {
- LOGE("no more track names available");
- }
- mVolume[0] = 1.0f;
- mVolume[1] = 1.0f;
- mStreamType = streamType;
- // NOTE: audio_track_cblk_t::frameSize for 8 bit PCM data is based on a sample size of
- // 16 bit because data is converted to 16 bit before being stored in buffer by AudioTrack
- mCblk->frameSize = AudioSystem::isLinearPCM(format) ? channelCount * sizeof(int16_t) : sizeof(int8_t);
}
AudioFlinger::PlaybackThread::Track::~Track()
@@ -2390,14 +2393,16 @@
channelCount, frameCount, flags, 0),
mOverflow(false)
{
- LOGV("RecordTrack constructor, size %d", (int)mBufferEnd - (int)mBuffer);
- if (format == AudioSystem::PCM_16_BIT) {
- mCblk->frameSize = channelCount * sizeof(int16_t);
- } else if (format == AudioSystem::PCM_8_BIT) {
- mCblk->frameSize = channelCount * sizeof(int8_t);
- } else {
- mCblk->frameSize = sizeof(int8_t);
- }
+ if (mCblk != NULL) {
+ LOGV("RecordTrack constructor, size %d", (int)mBufferEnd - (int)mBuffer);
+ if (format == AudioSystem::PCM_16_BIT) {
+ mCblk->frameSize = channelCount * sizeof(int16_t);
+ } else if (format == AudioSystem::PCM_8_BIT) {
+ mCblk->frameSize = channelCount * sizeof(int8_t);
+ } else {
+ mCblk->frameSize = sizeof(int8_t);
+ }
+ }
}
AudioFlinger::RecordThread::RecordTrack::~RecordTrack()
diff --git a/media/libmedia/IAudioFlinger.cpp b/media/libmedia/IAudioFlinger.cpp
index fc39a46..5089157 100644
--- a/media/libmedia/IAudioFlinger.cpp
+++ b/media/libmedia/IAudioFlinger.cpp
@@ -83,6 +83,7 @@
status_t *status)
{
Parcel data, reply;
+ sp<IAudioTrack> track;
data.writeInterfaceToken(IAudioFlinger::getInterfaceDescriptor());
data.writeInt32(pid);
data.writeInt32(streamType);
@@ -96,12 +97,14 @@
status_t lStatus = remote()->transact(CREATE_TRACK, data, &reply);
if (lStatus != NO_ERROR) {
LOGE("createTrack error: %s", strerror(-lStatus));
+ } else {
+ lStatus = reply.readInt32();
+ track = interface_cast<IAudioTrack>(reply.readStrongBinder());
}
- lStatus = reply.readInt32();
if (status) {
*status = lStatus;
}
- return interface_cast<IAudioTrack>(reply.readStrongBinder());
+ return track;
}
virtual sp<IAudioRecord> openRecord(
@@ -115,6 +118,7 @@
status_t *status)
{
Parcel data, reply;
+ sp<IAudioRecord> record;
data.writeInterfaceToken(IAudioFlinger::getInterfaceDescriptor());
data.writeInt32(pid);
data.writeInt32(input);
@@ -123,12 +127,17 @@
data.writeInt32(channelCount);
data.writeInt32(frameCount);
data.writeInt32(flags);
- remote()->transact(OPEN_RECORD, data, &reply);
- status_t lStatus = reply.readInt32();
+ status_t lStatus = remote()->transact(OPEN_RECORD, data, &reply);
+ if (lStatus != NO_ERROR) {
+ LOGE("openRecord error: %s", strerror(-lStatus));
+ } else {
+ lStatus = reply.readInt32();
+ record = interface_cast<IAudioRecord>(reply.readStrongBinder());
+ }
if (status) {
*status = lStatus;
}
- return interface_cast<IAudioRecord>(reply.readStrongBinder());
+ return record;
}
virtual uint32_t sampleRate(int output) const
diff --git a/media/libmedia/IAudioRecord.cpp b/media/libmedia/IAudioRecord.cpp
index 8fb5d3d..dacf75a 100644
--- a/media/libmedia/IAudioRecord.cpp
+++ b/media/libmedia/IAudioRecord.cpp
@@ -56,9 +56,13 @@
virtual sp<IMemory> getCblk() const
{
Parcel data, reply;
+ sp<IMemory> cblk;
data.writeInterfaceToken(IAudioRecord::getInterfaceDescriptor());
- remote()->transact(GET_CBLK, data, &reply);
- return interface_cast<IMemory>(reply.readStrongBinder());
+ status_t status = remote()->transact(GET_CBLK, data, &reply);
+ if (status == NO_ERROR) {
+ cblk = interface_cast<IMemory>(reply.readStrongBinder());
+ }
+ return cblk;
}
};
diff --git a/media/libmedia/IAudioTrack.cpp b/media/libmedia/IAudioTrack.cpp
index 75b861b..7f43347 100644
--- a/media/libmedia/IAudioTrack.cpp
+++ b/media/libmedia/IAudioTrack.cpp
@@ -81,9 +81,13 @@
virtual sp<IMemory> getCblk() const
{
Parcel data, reply;
+ sp<IMemory> cblk;
data.writeInterfaceToken(IAudioTrack::getInterfaceDescriptor());
- remote()->transact(GET_CBLK, data, &reply);
- return interface_cast<IMemory>(reply.readStrongBinder());
+ status_t status = remote()->transact(GET_CBLK, data, &reply);
+ if (status == NO_ERROR) {
+ cblk = interface_cast<IMemory>(reply.readStrongBinder());
+ }
+ return cblk;
}
};
