From 68b5a37d2779fd3325ce7ff9dc21fbd060276ecd Mon Sep 17 00:00:00 2001
From: Guang Qiao <guang.qiao@mediatek.com>
Date: Wed, 13 Nov 2019 16:24:59 +0800
Subject: [PATCH] MPEG4Writer:Fix MetaData use-after-free issue

MediaCodecSource's mMeta would be replaced if encoder posts
OUTPUT_FORMAT_CHANGED message.  MPEG4Writer needs to hold
the old mMeta to use its variables.

Bug: 144537993
Test: run cts -m CtsMediaTestCases -t android.media.cts.MediaRecorderTest
Change-Id: I52345a35fb8472bd58165e9060297f8d13f3b6fc
---
 media/libstagefright/MPEG4Writer.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/media/libstagefright/MPEG4Writer.cpp b/media/libstagefright/MPEG4Writer.cpp
index f130c9b082..128ce8bf50 100644
--- a/media/libstagefright/MPEG4Writer.cpp
+++ b/media/libstagefright/MPEG4Writer.cpp
@@ -614,7 +614,8 @@ status_t MPEG4Writer::addSource(const sp<MediaSource> &source) {
     CHECK(source.get() != NULL);
 
     const char *mime;
-    source->getFormat()->findCString(kKeyMIMEType, &mime);
+    sp<MetaData> meta = source->getFormat();
+    meta->findCString(kKeyMIMEType, &mime);
 
     if (Track::getFourCCForMime(mime) == NULL) {
         ALOGE("Unsupported mime '%s'", mime);