commit 80b1dc175b4d28e1af04218c94a63deb53eae217
author TreeHugger Robot <treehugger-gerrit@google.com> Sat Mar 16 00:11:17 2019 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Sat Mar 16 00:11:17 2019 +0000
tree c9aab67ed71f62938df99ff30bb5dd10de74b945
parent ff3abed98f3d50cc49ed4ff143bfb26264d6994a
parent 37b6f2593f64f949e3f07ee2da7ab9c77025be72

Merge "MediaPlayer: fix use after free for mMediaTimeProvider"

media/java/android/media/MediaPlayer.java

diff --git a/media/java/android/media/MediaPlayer.java b/media/java/android/media/MediaPlayer.java
index abbfa88..040152a 100644
--- a/media/java/android/media/MediaPlayer.java
+++ b/media/java/android/media/MediaPlayer.java
@@ -2645,7 +2645,7 @@
      */
     private synchronized void setSubtitleAnchor() {
         if ((mSubtitleController == null) && (ActivityThread.currentApplication() != null)) {
-            getMediaTimeProvider();
+            final TimeProvider timeProvider = (TimeProvider) getMediaTimeProvider();
             final HandlerThread thread = new HandlerThread("SetSubtitleAnchorThread");
             thread.start();
             Handler handler = new Handler(thread.getLooper());
@@ -2653,7 +2653,8 @@
                 @Override
                 public void run() {
                     Context context = ActivityThread.currentApplication();
-                    mSubtitleController = new SubtitleController(context, mTimeProvider, MediaPlayer.this);
+                    mSubtitleController =
+                            new SubtitleController(context, timeProvider, MediaPlayer.this);
                     mSubtitleController.setAnchor(new Anchor() {
                         @Override
                         public void setSubtitleWidget(RenderingWidget subtitleWidget) {
@@ -2661,7 +2662,7 @@
 
                         @Override
                         public Looper getSubtitleLooper() {
-                            return mTimeProvider.mEventHandler.getLooper();
+                            return timeProvider.mEventHandler.getLooper();
                         }
                     });
                     thread.getLooper().quitSafely();

media/java/android/media/SubtitleTrack.java

diff --git a/media/java/android/media/SubtitleTrack.java b/media/java/android/media/SubtitleTrack.java
index 5596c32..0705d97 100644
--- a/media/java/android/media/SubtitleTrack.java
+++ b/media/java/android/media/SubtitleTrack.java
@@ -263,7 +263,9 @@
         }
         updateView(mActiveCues);
         mNextScheduledTimeMs = -1;
-        mTimeProvider.notifyAt(MediaTimeProvider.NO_TIME, this);
+        if (mTimeProvider != null) {
+            mTimeProvider.notifyAt(MediaTimeProvider.NO_TIME, this);
+        }
     }
 
     /** @hide */