Cursor leakage due to cancellation signal

If a query call was cancelled, the cursor adaptor might leak. The
adaptor is now closed if any exception is thrown during query.

Change-Id: Ic4c2edeaf2fcef56b4ef59484a36d3233aa12dbc

diff --git a/core/java/android/content/ContentProviderNative.java b/core/java/android/content/ContentProviderNative.java
index bcf0b63..39286d6 100644 (file)
--- a/core/java/android/content/ContentProviderNative.java
+++ b/core/java/android/content/ContentProviderNative.java
@@ -112,17 +112,24 @@ abstract public class ContentProviderNative extends Binder implements IContentPr
                     Cursor cursor = query(callingPkg, url, projection, selection, selectionArgs,
                             sortOrder, cancellationSignal);
                     if (cursor != null) {
+                        CursorToBulkCursorAdaptor adaptor = null;
+
                         try {
-                            CursorToBulkCursorAdaptor adaptor = new CursorToBulkCursorAdaptor(
-                                    cursor, observer, getProviderName());
-                            BulkCursorDescriptor d = adaptor.getBulkCursorDescriptor();
+                            adaptor = new CursorToBulkCursorAdaptor(cursor, observer,
+                                    getProviderName());
                             cursor = null;
 
+                            BulkCursorDescriptor d = adaptor.getBulkCursorDescriptor();
+                            adaptor = null;
+
                             reply.writeNoException();
                             reply.writeInt(1);
                             d.writeToParcel(reply, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
                         } finally {
                             // Close cursor if an exception was thrown while constructing the adaptor.
+                            if (adaptor != null) {
+                                adaptor.close();
+                            }
                             if (cursor != null) {
                                 cursor.close();
                             }