Use strong pointer in ALooper to avoid use-after-free
If the endpoint that has a reference to the ASensorEventQueue goes away
without calling ASensorManager_destroyEventQueue, then the event queue's
reference goes to 0. This causes the event queue to be destroyed, but
the looper may still call it since it hasn't been invalidated yet
causing a use-after-free.
To avoid this, store the event queue as a weak pointer in the looper's
queue and attempt to promote it to a strong pointer when it needs to be
used. If it can't be promoted, then it is ignored and cleared later.
Bug: 175074139
Test: Load Android firmware image and run the camera app to verify no
crashes are seen.
Merged-In: I1439bf9c0a725818889f7be64e234d952363f4db
Change-Id: I1439bf9c0a725818889f7be64e234d952363f4db
(cherry picked from commit 7d712cfe6ddf86c07c4f2baee74ec948c7fc72d0)
2 files changed
