commit 338be396b5f1f32cbae61564403c0185a63bab7a
author Tom Cherry <tomcherry@google.com> Tue Aug 09 14:15:33 2016 -0700
committer Tom Cherry <tomcherry@google.com> Tue Aug 09 14:15:33 2016 -0700
tree 5e13c15f8b2a3b740a2e8768ffa029e8ca707f18
parent 45efcb0c7314f2238786743b6318cd5c5a7fd0fc

gralloc: Add missing va_end()

Add missing va_end() and additionally extra protection in the
deconstructor in case of use after free.

Bug: 30483149
Change-Id: Ib28c6312b67654e19d89c7b9acf03f26a8640ad3

msm8909/libgralloc/gralloc_priv.h

diff --git a/msm8909/libgralloc/gralloc_priv.h b/msm8909/libgralloc/gralloc_priv.h
index 2d19517..6295fb0 100644
--- a/msm8909/libgralloc/gralloc_priv.h
+++ b/msm8909/libgralloc/gralloc_priv.h
@@ -248,7 +248,9 @@
             numFds = sNumFds;
         }
         ~private_handle_t() {
+            base_metadata = 0;
             magic = 0;
+            fd_metadata = 0;
         }
 
         bool usesPhysicallyContiguousMemory() {

msm8909/libgralloc/mapper.cpp

diff --git a/msm8909/libgralloc/mapper.cpp b/msm8909/libgralloc/mapper.cpp
index ba8f5be..99d309c 100644
--- a/msm8909/libgralloc/mapper.cpp
+++ b/msm8909/libgralloc/mapper.cpp
@@ -365,6 +365,7 @@
                 private_handle_t* hnd =  va_arg(args, private_handle_t*);
                 int *stride = va_arg(args, int *);
                 if (private_handle_t::validate(hnd)) {
+                    va_end(args);
                     return res;
                 }
                 MetaData_t *metadata = (MetaData_t *)hnd->base_metadata;
@@ -382,6 +383,7 @@
                 int *stride = va_arg(args, int *);
                 int *height = va_arg(args, int *);
                 if (private_handle_t::validate(hnd)) {
+                    va_end(args);
                     return res;
                 }
                 MetaData_t *metadata = (MetaData_t *)hnd->base_metadata;
@@ -416,6 +418,7 @@
                 private_handle_t* hnd =  va_arg(args, private_handle_t*);
                 int *color_space = va_arg(args, int *);
                 if (private_handle_t::validate(hnd)) {
+                    va_end(args);
                     return res;
                 }
                 MetaData_t *metadata = (MetaData_t *)hnd->base_metadata;