OSDN Git Service

Fix thread race caused double free issue.
authorsongjinshi <songjinshi@xiaomi.com>
Thu, 8 Sep 2016 07:24:30 +0000 (15:24 +0800)
committerAdam Lesinski <adamlesinski@google.com>
Mon, 3 Oct 2016 20:13:12 +0000 (20:13 +0000)
commit5754b41c201a388e4e932b18d285d765d7e63536
tree4ed936836cbad3be2bf58e65e3b6c71b380ea173
parentbf79852ae4ffdeee8c31d6b852ebc4ad8062de37
Fix thread race caused double free issue.

The SharedZip's Asset is not thread-safety,the getResourceTableAsset()
and setResourceTableAsset(Asset* asset) function of the SharedZip is
not sync with a same lock.

Consider the following sequence of events:
Thread A calls setResourceTableAsset(Asset* asset),it will set
mResourceTableAsset = asset; then to calls getBuffer() of the asset.
Thread B calls getResourceTableAsset(),which return mResourceTableAsset,
then to calls getBuffer() of the mResourceTableAsset,the asset and
mResourceTableAsset is same one object.
Thread A to delete mZipInflater in getBuffer().
Thread B to delete mZipInflater in getBuffer().

It will cause crash becuase double delete mZipInflater in getBuffer().

https://code.google.com/p/android/issues/detail?id=211941

Bug:31734545
Change-Id: I5a7d67fdf64c4aa03f505b37a2fa840f4443d158
Signed-off-by: songjinshi <songjinshi@xiaomi.com>
libs/androidfw/AssetManager.cpp