| commit | e88055bb15b9157234fc33aa46516da0b4591da7 | [log] [tgz] |
|---|---|---|
| author | Steven Moreland <smoreland@google.com> | Wed Mar 13 09:23:18 2019 -0700 |
| committer | Steven Moreland <smoreland@google.com> | Wed Mar 13 09:25:20 2019 -0700 |
| tree | 2727d2153ea028907d4245fecd3723e46d1e7b82 | |
| parent | 873f49999447c705dac1e1c7537d0a9bdf4d27c0 [diff] |
libbinder_ndk: fix UB memory access for race AIBinder_DeathRecipient holds a strong pointer to its internal class TransferDeathRecipient. If a user deletes a death recipient at the same time a binder dies, the TDR still holds a reference to the AIBinder_DeathRecipient object that may be invalidated. Bug: N/A Test: build, boot, and ./runtests.sh Change-Id: Ic4cbc50c2d85ce52e36d4b157a50d0c75048e664