diff options
| author | Christer Fletcher <christer.fletcher@sonymobile.com> | 2013-06-18 08:55:09 +0200 |
|---|---|---|
| committer | Takeshi Aimi <takeshi.aimi@sonymobile.com> | 2013-06-28 17:00:38 +0900 |
| commit | fca812565cebd229fba8be32bad14983c5252a7b (patch) | |
| tree | 6d1663f287bf0d1ab9721f70c6271ed4cf0a0400 | |
| parent | d74a9ee83fd6e033fd2260ca3777390d7e5f817a (diff) | |
Set u.ext_data to null after it has been freed
SEGV_MAPPER crash could happen in MetaData::typed_data::freeStorage.
The faulty address could be both random pointers and deadbaad. It
seems like free could be called more than once on u.ext_data. Set
u.ext_data to null after it has been freed as there already is a
null check before trying to free it.
Change-Id: I710c49f9c231bd8852159914c0b2add58a685f0e
| -rw-r--r-- | media/libstagefright/MetaData.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/media/libstagefright/MetaData.cpp b/media/libstagefright/MetaData.cpp index a01ec978..ae6ae2d7 100644 --- a/media/libstagefright/MetaData.cpp +++ b/media/libstagefright/MetaData.cpp @@ -282,6 +282,7 @@ void MetaData::typed_data::freeStorage() { if (!usesReservoir()) { if (u.ext_data) { free(u.ext_data); + u.ext_data = NULL; } } |