From 65166fe47da62447310b67303ab9db9e5820178c Mon Sep 17 00:00:00 2001
From: Fabien Sanglard <sanglardf@google.com>
Date: Tue, 8 Nov 2016 15:31:32 -0800
Subject: Fix SF security vulnerability: 32660278

Because of lack of mutex lock when get mSidebandStream, if one thread
getSidebandStream, another thread setSidebandStream frequently, an UAF
will be triggered.

Bug: 32660278
Test: Marlin device with poc
Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45
(cherry picked from commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843)
(cherry picked from commit 675e212c8c6653825cc3352c603caf2e40b00f9f)
---
 libs/gui/BufferQueueConsumer.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index 7504ed4..7aea4bb 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -572,6 +572,7 @@ status_t BufferQueueConsumer::setTransformHint(uint32_t hint) {
 }
 
 sp<NativeHandle> BufferQueueConsumer::getSidebandStream() const {
+    Mutex::Autolock lock(mCore->mMutex);
     return mCore->mSidebandStream;
 }
 
-- 
cgit v1.1