Andrew Lehmer 1e9c510d49 folio_daemon: Avoid UAF with stale sensor handle
It is possible for sensor handles retrieved using
ASensorManager_getDefaultSensor() to become stale if the underlying
binder connection to the sensor service gets reset. This can be
triggered by ASensorManager_createEventQueue(), so any sensor handle
retrieved prior to this call may become stale, resulting in a use-after-
free when the handle is eventually registered with the queue. To avoid
this, the event queue is created before retrieving or registering the
sensor.

Bug: 150225255
Test: No longer crashes with proof-of-concept on Pixel 2 XL.
Change-Id: I243f6c68c734af3eb5488855d965a894b5fb99e5
2020-03-30 22:36:21 +00:00
2017-06-30 01:33:36 +00:00
2017-08-07 09:38:56 -07:00
2017-08-07 11:02:58 -07:00
2017-05-25 11:40:24 -07:00
2017-08-31 16:06:58 -07:00
2017-03-21 10:28:34 -07:00
2017-09-10 16:50:08 -07:00
2017-08-02 17:56:15 -07:00
Description
No description provided
4.4 MiB
Languages
C++ 54.8%
Makefile 33.2%
C 5.5%
Shell 4.6%
Python 1.3%
Other 0.6%