commit 9b3b39a5e8c432e42121f2520a3cea4098698d90
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Wed Jun 20 11:22:38 2018 -0700
committer Pawin Vongmasa <pawin@google.com> Tue Jun 26 14:12:32 2018 -0700
tree 1ecb1098261b022d17df52424391b29d0abaae9f
parent f6ca3cb07b1df4a830f41b26d77fa280104884e8

C2SoftXaacDec: Handle multiple onRelease calls

Set allocated pointers to null after free to handle multiple calls to
onRelease() and avoid an use after free error.

Bug: 110441447
Test: -m CtsMediaTestCases -t android.media.cts.MediaCodecCapabilitiesTest#\
       testGetMaxSupportedInstances

Change-Id: Iab9af0c5b82ccf85fdc2f6fd2fd98ceb1ede038b

media/codecs/xaac/C2SoftXaacDec.cpp

diff --git a/media/codecs/xaac/C2SoftXaacDec.cpp b/media/codecs/xaac/C2SoftXaacDec.cpp
index d77dd9e..ed5290a 100644
--- a/media/codecs/xaac/C2SoftXaacDec.cpp
+++ b/media/codecs/xaac/C2SoftXaacDec.cpp
@@ -894,21 +894,21 @@
 IA_ERRORCODE C2SoftXaacDec::deInitXAACDecoder() {
     ALOGV("deInitXAACDecoder");
 
-    /* Error code */
     IA_ERRORCODE err_code = IA_NO_ERROR;
-
-    /* Tell that the input is over in this buffer */
-    err_code = ixheaacd_dec_api(mXheaacCodecHandle,
-                                IA_API_CMD_INPUT_OVER,
-                                0,
-                                NULL);
-
+    if (mXheaacCodecHandle) {
+        /* Tell that the input is over in this buffer */
+        err_code = ixheaacd_dec_api(mXheaacCodecHandle,
+                                    IA_API_CMD_INPUT_OVER,
+                                    0,
+                                    NULL);
+        mXheaacCodecHandle = nullptr;
+    }
     /* Irrespective of error returned in IA_API_CMD_INPUT_OVER, free allocated memory */
     for (void* buf : mMemoryVec) {
         free(buf);
     }
     mMemoryVec.clear();
-
+    mMpegDDrcHandle = nullptr;
     return err_code;
 }