Skip to content

Commit 2feaadd

Browse files
songlongdaiduongMocaRafee
authored andcommitted
hwui: Add NULL pointer check in AnimatorManager::pushStaging
Fix NULL deref ``` Cmdline: com.android.systemui pid: 2530, tid: 2589, name: RenderThread >>> com.android.systemui <<< uid: 10293 signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000010 Cause: null pointer dereference x0 b400007cbe7b8ff0 x1 0000007bf78fb9f0 x2 b400007c8c184898 x3 0000000000000001 x4 0000007bf78faf80 x5 00000000007f5687 x6 000000001991ade0 x7 0000000000000010 x8 0000000000000000 x9 43490de4ff9b0700 x10 b400007cbe7b8c00 x11 0000000000000002 x12 0000000000000000 x13 000000003f800000 x14 000000003f800000 x15 0000000000000000 x16 0000007d71724720 x17 0000007d57ccdb00 x18 0000007bf7568000 x19 b400007cbe7b8ff0 x20 b400007cbe7b9018 x21 b400007cbe7b8ff0 x22 b400007cbe280010 x23 b400007cbe280000 x24 7ffffffffffffff8 x25 1fffffffffffffff x26 00000000ffffffff x27 b400007c7e1b0da8 x28 0000007bf78fc000 x29 0000007bf78fb7a0 lr 0000007d67aaf330 sp 0000007bf78fb7a0 pc 0000007d67ab1590 pst 0000000020001000 backtrace: #00 pc 0000000000253590 /system/lib64/libhwui.so (android::uirenderer::AnimatorManager::pushStaging()+112) LineageOS#1 pc 000000000025132c /system/lib64/libhwui.so (android::uirenderer::AnimationContext::runRemainingAnimations(android::uirenderer::TreeInfo&)+44) LineageOS#2 pc 0000000000267664 /system/lib64/libhwui.so (android::uirenderer::AnimationContextBridge::runRemainingAnimations(android::uirenderer::TreeInfo&)+36) LineageOS#3 pc 0000000000292720 /system/lib64/libhwui.so (android::uirenderer::renderthread::CanvasContext::prepareTree(android::uirenderer::TreeInfo&, long*, long, android::uirenderer::RenderNode*)+352) LineageOS#4 pc 00000000002959c8 /system/lib64/libhwui.so (std::__1::__function::__func<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0, std::__1::allocator<android::uirenderer::renderthread::DrawFrameTask::postAndWait()::$_0>, void ()>::operator()() (.c1671e787f244890c877724752face20)+360) LineageOS#5 pc 0000000000282ce4 /system/lib64/libhwui.so (android::uirenderer::WorkQueue::process()+1108) LineageOS#6 pc 00000000002a808c /system/lib64/libhwui.so (android::uirenderer::renderthread::RenderThread::threadLoop()+556) LineageOS#7 pc 0000000000013a14 /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+436) LineageOS#8 pc 00000000000d07ac /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204) LineageOS#9 pc 00000000000567f0 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) ``` Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
1 parent 1ae9f93 commit 2feaadd

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

libs/hwui/AnimatorManager.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ void AnimatorManager::pushStaging() {
7777

7878
// Only add new animators that are not already in the mAnimators list
7979
for (auto& anim : mNewAnimators) {
80-
if (anim->target() != &mParent) {
80+
if (anim && anim->target() != &mParent) {
8181
mAnimators.push_back(std::move(anim));
8282
}
8383
}
@@ -86,12 +86,14 @@ void AnimatorManager::pushStaging() {
8686

8787
if (mCancelAllAnimators) {
8888
for (auto& animator : mAnimators) {
89-
animator->forceEndNow(mAnimationHandle->context());
89+
if (animator)
90+
animator->forceEndNow(mAnimationHandle->context());
9091
}
9192
mCancelAllAnimators = false;
9293
} else {
9394
for (auto& animator : mAnimators) {
94-
animator->pushStaging(mAnimationHandle->context());
95+
if (animator)
96+
animator->pushStaging(mAnimationHandle->context());
9597
}
9698
}
9799
}

0 commit comments

Comments
 (0)