From 61c3fcf746edd9f2ac83a232fb87eac019aea1c7 Mon Sep 17 00:00:00 2001
From: Steven Moreland <smoreland@google.com>
Date: Tue, 27 Apr 2021 00:04:38 +0000
Subject: [PATCH] libhwui: AnimatedImageThread - UAF

Fix branch subject to UAF.

Bug: 186468053
Test: atest android.graphics.drawable.cts.AnimatedImageDrawableTest
    (w/ UAF detection enabled in libutils Thread)
Change-Id: Idb45f5ef41436920d0ce00f609fa25fb8fdccddf
---
 libs/hwui/hwui/AnimatedImageThread.cpp | 9 ++++++---
 libs/hwui/hwui/AnimatedImageThread.h   | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/libs/hwui/hwui/AnimatedImageThread.cpp b/libs/hwui/hwui/AnimatedImageThread.cpp
index c8990039875e2..3d5841d308fb7 100644
--- a/libs/hwui/hwui/AnimatedImageThread.cpp
+++ b/libs/hwui/hwui/AnimatedImageThread.cpp
@@ -22,13 +22,16 @@ namespace android {
 namespace uirenderer {
 
 AnimatedImageThread& AnimatedImageThread::getInstance() {
-    static AnimatedImageThread* sInstance = new AnimatedImageThread();
-    return *sInstance;
+    [[clang::no_destroy]] static sp<AnimatedImageThread> sInstance = []() {
+        sp<AnimatedImageThread> thread = sp<AnimatedImageThread>::make();
+        thread->start("AnimatedImageThread");
+        return thread;
+    }();
+    return *sInstance.get();
 }
 
 AnimatedImageThread::AnimatedImageThread() {
     setpriority(PRIO_PROCESS, 0, PRIORITY_NORMAL + PRIORITY_MORE_FAVORABLE);
-    start("AnimatedImageThread");
 }
 
 std::future<AnimatedImageDrawable::Snapshot> AnimatedImageThread::decodeNextFrame(
diff --git a/libs/hwui/hwui/AnimatedImageThread.h b/libs/hwui/hwui/AnimatedImageThread.h
index 9e3537430d5aa..fac80e5310e8b 100644
--- a/libs/hwui/hwui/AnimatedImageThread.h
+++ b/libs/hwui/hwui/AnimatedImageThread.h
@@ -37,6 +37,7 @@ public:
     std::future<AnimatedImageDrawable::Snapshot> reset(const sk_sp<AnimatedImageDrawable>&);
 
 private:
+    friend sp<AnimatedImageThread>;
     AnimatedImageThread();
 };