Andrew Lehmer 948ad9c58c folio_daemon: Avoid UAF with stale sensor handle ...

It is possible for sensor handles retrieved using
ASensorManager_getDefaultSensor() to become stale if the underlying
binder connection to the sensor service gets reset. This can be
triggered by ASensorManager_createEventQueue(), so any sensor handle
retrieved prior to this call may become stale, resulting in a use-after-
free when the handle is eventually registered with the queue. To avoid
this, the event queue is created before retrieving or registering the
sensor.

Bug: 150225255
Test: No longer crashes with proof-of-concept on Pixel 2 XL.
Change-Id: I243f6c68c734af3eb5488855d965a894b5fb99e5

2020-03-30 22:35:46 +00:00

..

Android.mk

Disable modules that can't be built in PDK

2018-03-08 17:50:19 +09:00

main.cpp

folio_daemon: Avoid UAF with stale sensor handle

2020-03-30 22:35:46 +00:00