commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843
author Fabien Sanglard <sanglardf@google.com> Tue Nov 08 15:31:32 2016 -0800
committer Fabien Sanglard <sanglardf@google.com> Wed Nov 09 00:08:45 2016 +0000
tree 90cf5c62826432e9e9e4493adf154e634af007ff
parent e6bbe69ba739c8a08837134437aaccfea5f1d943

Fix SF security vulnerability: 32660278

Because of lack of mutex lock when get mSidebandStream, if one thread
getSidebandStream, another thread setSidebandStream frequently, an UAF
will be triggered.

Bug: 32660278
Test: Marlin device with poc
Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45

libs/gui/BufferQueueConsumer.cpp

diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index d62eaf7..bc6f3f0 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -517,6 +517,7 @@
 }
 
 sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const {
+    Mutex::Autolock lock(mCore->mMutex);
     return mCore->mSidebandStream;
 }