From 55eda43af9f71b098c434cab831795d7ca8842ac Mon Sep 17 00:00:00 2001
From: Peter Eliasson <peter.eliasson@sonymobile.com>
Date: Fri, 28 Jun 2013 13:55:41 +0200
Subject: [PATCH] Cursor leakage due to cancellation signal

If a query call was cancelled, the cursor adaptor might leak. The
adaptor is now closed if any exception is thrown during query.

Change-Id: Ic4c2edeaf2fcef56b4ef59484a36d3233aa12dbc
---
 .../java/android/content/ContentProviderNative.java | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/core/java/android/content/ContentProviderNative.java b/core/java/android/content/ContentProviderNative.java
index bcf0b637a2136..39286d6ea9b67 100644
--- a/core/java/android/content/ContentProviderNative.java
+++ b/core/java/android/content/ContentProviderNative.java
@@ -112,17 +112,24 @@ abstract public class ContentProviderNative extends Binder implements IContentPr
                     Cursor cursor = query(callingPkg, url, projection, selection, selectionArgs,
                             sortOrder, cancellationSignal);
                     if (cursor != null) {
+                        CursorToBulkCursorAdaptor adaptor = null;
+
                         try {
-                            CursorToBulkCursorAdaptor adaptor = new CursorToBulkCursorAdaptor(
-                                    cursor, observer, getProviderName());
-                            BulkCursorDescriptor d = adaptor.getBulkCursorDescriptor();
+                            adaptor = new CursorToBulkCursorAdaptor(cursor, observer,
+                                    getProviderName());
                             cursor = null;
 
+                            BulkCursorDescriptor d = adaptor.getBulkCursorDescriptor();
+                            adaptor = null;
+
                             reply.writeNoException();
                             reply.writeInt(1);
                             d.writeToParcel(reply, Parcelable.PARCELABLE_WRITE_RETURN_VALUE);
                         } finally {
                             // Close cursor if an exception was thrown while constructing the adaptor.
+                            if (adaptor != null) {
+                                adaptor.close();
+                            }
                             if (cursor != null) {
                                 cursor.close();
                             }