From 301dd5f1d99993725cb6336e6d520904e23ce925 Mon Sep 17 00:00:00 2001
From: Pawin Vongmasa <pawin@google.com>
Date: Tue, 4 Feb 2020 00:40:33 -0800
Subject: [PATCH] OMXNodeInstance: Guard mActiveBuffers by mLock

Test: atest CtsMediaTestCases

Bug: 135003556
Bug: 142777721
Change-Id: I02b5c0be94a674fe21884d9faa0c0c9cfbedd5fc
Merged-In: I02b5c0be94a674fe21884d9faa0c0c9cfbedd5fc
(cherry picked from commit 0329492f9e2169ddba5b19f379ddc842db1efdb1)
---
 media/libstagefright/omx/OMXNodeInstance.cpp | 24 +++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 2f69f45e72..5b2f6de432 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -47,6 +47,8 @@
 
 #include <hidlmemory/mapping.h>
 
+#include <vector>
+
 static const OMX_U32 kPortIndexInput = 0;
 static const OMX_U32 kPortIndexOutput = 1;
 
@@ -493,9 +495,7 @@ status_t OMXNodeInstance::freeNode() {
 
         case OMX_StateLoaded:
         {
-            if (mActiveBuffers.size() > 0) {
-                freeActiveBuffers();
-            }
+            freeActiveBuffers();
             FALLTHROUGH_INTENDED;
         }
         case OMX_StateInvalid:
@@ -2430,11 +2430,19 @@ void OMXNodeInstance::removeActiveBuffer(
 }
 
 void OMXNodeInstance::freeActiveBuffers() {
-    // Make sure to count down here, as freeBuffer will in turn remove
-    // the active buffer from the vector...
-    for (size_t i = mActiveBuffers.size(); i > 0;) {
-        i--;
-        freeBuffer(mActiveBuffers[i].mPortIndex, mActiveBuffers[i].mID);
+    std::vector<OMX_U32> portIndices;
+    std::vector<IOMX::buffer_id> bufferIds;
+    {
+        // Access to mActiveBuffers must be protected by mLock.
+        Mutex::Autolock _l(mLock);
+        for (const ActiveBuffer& activeBuffer : mActiveBuffers) {
+            portIndices.emplace_back(activeBuffer.mPortIndex);
+            bufferIds.emplace_back(activeBuffer.mID);
+        }
+    }
+    for (size_t i = bufferIds.size(); i > 0; ) {
+        --i;
+        freeBuffer(portIndices[i], bufferIds[i]);
     }
 }