richard pushed to branch tor-browser-102.12.0esr-12.5-1 at The Tor Project / Applications / Tor Browser

Commits: 7ece5b1d by John Lin at 2023-06-06T16:11:52+00:00 Bug 1832832 - protect encoder accesses in Java callbacks. r=media-playback-reviewers,alwu a=pascalc

Differential Revision: https://phabricator.services.mozilla.com/D178564 - - - - -

2 changed files:

- dom/media/platforms/android/AndroidDataEncoder.cpp - dom/media/platforms/android/AndroidDataEncoder.h

Changes:

===================================== dom/media/platforms/android/AndroidDataEncoder.cpp ===================================== @@ -494,7 +494,10 @@ void AndroidDataEncoder<ConfigType>::CallbacksSupport::HandleInput( template <typename ConfigType> void AndroidDataEncoder<ConfigType>::CallbacksSupport::HandleOutput( java::Sample::Param aSample, java::SampleBuffer::Param aBuffer) { - mEncoder->ProcessOutput(std::move(aSample), std::move(aBuffer)); + MutexAutoLock lock(mMutex); + if (mEncoder) { + mEncoder->ProcessOutput(std::move(aSample), std::move(aBuffer)); + } }

template <typename ConfigType> @@ -504,7 +507,10 @@ void AndroidDataEncoder<ConfigType>::CallbacksSupport:: template <typename ConfigType> void AndroidDataEncoder<ConfigType>::CallbacksSupport::HandleError( const MediaResult& aError) { - mEncoder->Error(aError); + MutexAutoLock lock(mMutex); + if (mEncoder) { + mEncoder->Error(aError); + } }

// Force compiler to generate code.

===================================== dom/media/platforms/android/AndroidDataEncoder.h ===================================== @@ -13,6 +13,7 @@

#include "mozilla/Maybe.h" #include "mozilla/Monitor.h" +#include "mozilla/Mutex.h"

namespace mozilla {

@@ -36,7 +37,15 @@ class AndroidDataEncoder final : public MediaDataEncoder { class CallbacksSupport final : public JavaCallbacksSupport { public: explicit CallbacksSupport(AndroidDataEncoder* aEncoder) - : mEncoder(aEncoder) {} + : mMutex("AndroidDataEncoder::CallbacksSupport") { + MutexAutoLock lock(mMutex); + mEncoder = aEncoder; + } + + ~CallbacksSupport() { + MutexAutoLock lock(mMutex); + mEncoder = nullptr; + }

void HandleInput(int64_t aTimestamp, bool aProcessed) override; void HandleOutput(java::Sample::Param aSample, @@ -46,7 +55,8 @@ class AndroidDataEncoder final : public MediaDataEncoder { void HandleError(const MediaResult& aError) override;

private: - AndroidDataEncoder* mEncoder; + Mutex mMutex; + AndroidDataEncoder* mEncoder MOZ_GUARDED_BY(mMutex); }; friend class CallbacksSupport;

View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7ece5b1d...