tree eedb1c4a03292d35da38f6f4ae519ca0d4b79700
parent ed3f73e92a9aee279b60e174b443fd08bac2b847
author Dongwon Kang <dwkang@google.com> 1529535945 -0700
committer Dongwon Kang <dwkang@google.com> 1529539314 +0000

Fix a race condition in OMXNodeInstance

When it frees the buffers, there might be pending events in
OMX::CallbackDispatcher and these event can be handled after
the component frees the buffers. To prevent the UAF case, this
change invalidates the buffers in the client side first before
calling OMX_FreeBuffer.

Test: run poc with and without the patch
Test: cts-tradefed run cts-dev --module CtsMediaTestCases
      --compatibility:module-arg CtsMediaTestCases:include-annotation:
      android.platform.test.annotations.RequiresDevice
Bug: 77474014
Change-Id: I0b7c4291967564f697e7f6a5ecbc31d4dae3cbcd