From 9f6d6ae26c1f0a6d03fb8c035565a25104aa3c6d Mon Sep 17 00:00:00 2001
From: Mikhail Naganov <mnaganov@google.com>
Date: Wed, 5 May 2021 18:07:59 -0700
Subject: [PATCH] audio HAL - fix UAFs

resolve merge conflicts of bd78085f08d5e342a1e0b02dde7a25832c2dd62e to pi-dev

Bug: 185259758
Test: N/A
Change-Id: Ia85fb88e85e94b4d63fc155d89063bba6c61e875
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
---
 .../include/core/all-versions/default/StreamIn.impl.h     | 8 ++++----
 .../include/core/all-versions/default/StreamOut.impl.h    | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/audio/core/all-versions/default/include/core/all-versions/default/StreamIn.impl.h b/audio/core/all-versions/default/include/core/all-versions/default/StreamIn.impl.h
index 64c85ab5fc..adad331de1 100644
--- a/audio/core/all-versions/default/include/core/all-versions/default/StreamIn.impl.h
+++ b/audio/core/all-versions/default/include/core/all-versions/default/StreamIn.impl.h
@@ -387,9 +387,9 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun
     }
 
     // Create and launch the thread.
-    auto tempReadThread =
-        std::make_unique<ReadThread>(&mStopReadThread, mStream, tempCommandMQ.get(),
-                                     tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());
+    sp<ReadThread> tempReadThread =
+        new ReadThread(&mStopReadThread, mStream, tempCommandMQ.get(),
+                       tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());
     if (!tempReadThread->init()) {
         ALOGW("failed to start reader thread: %s", strerror(-status));
         sendError(Result::INVALID_ARGUMENTS);
@@ -405,7 +405,7 @@ Return<void> StreamIn::prepareForReading(uint32_t frameSize, uint32_t framesCoun
     mCommandMQ = std::move(tempCommandMQ);
     mDataMQ = std::move(tempDataMQ);
     mStatusMQ = std::move(tempStatusMQ);
-    mReadThread = tempReadThread.release();
+    mReadThread = tempReadThread;
     mEfGroup = tempElfGroup.release();
     threadInfo.pid = getpid();
     threadInfo.tid = mReadThread->getTid();
diff --git a/audio/core/all-versions/default/include/core/all-versions/default/StreamOut.impl.h b/audio/core/all-versions/default/include/core/all-versions/default/StreamOut.impl.h
index 6fb157f7de..a49059ccba 100644
--- a/audio/core/all-versions/default/include/core/all-versions/default/StreamOut.impl.h
+++ b/audio/core/all-versions/default/include/core/all-versions/default/StreamOut.impl.h
@@ -370,9 +370,9 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou
     }
 
     // Create and launch the thread.
-    auto tempWriteThread =
-        std::make_unique<WriteThread>(&mStopWriteThread, mStream, tempCommandMQ.get(),
-                                      tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());
+    sp<WriteThread> tempWriteThread =
+        new WriteThread(&mStopWriteThread, mStream, tempCommandMQ.get(),
+                        tempDataMQ.get(), tempStatusMQ.get(), tempElfGroup.get());
     if (!tempWriteThread->init()) {
         ALOGW("failed to start writer thread: %s", strerror(-status));
         sendError(Result::INVALID_ARGUMENTS);
@@ -388,7 +388,7 @@ Return<void> StreamOut::prepareForWriting(uint32_t frameSize, uint32_t framesCou
     mCommandMQ = std::move(tempCommandMQ);
     mDataMQ = std::move(tempDataMQ);
     mStatusMQ = std::move(tempStatusMQ);
-    mWriteThread = tempWriteThread.release();
+    mWriteThread = tempWriteThread;
     mEfGroup = tempElfGroup.release();
     threadInfo.pid = getpid();
     threadInfo.tid = mWriteThread->getTid();