From 77aa15297dedd98d5b233ca164ed7dbe6e0fe14a Mon Sep 17 00:00:00 2001
From: John Reck <jreck@google.com>
Date: Thu, 29 Jun 2017 10:26:44 -0700
Subject: [PATCH] Fix use-after-free

Change-Id: I8ac1ede5b29f718aa145e18cf1cc057722b62f2b
Fixes: 62810849
Test: Builds
(cherry picked from commit 3c1820e0104b8e48f55cab491f82e84bf0a6081f)
---
 services/core/jni/com_android_server_GraphicsStatsService.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/core/jni/com_android_server_GraphicsStatsService.cpp b/services/core/jni/com_android_server_GraphicsStatsService.cpp
index 5d5728da61af2..61c53e6d30b31 100644
--- a/services/core/jni/com_android_server_GraphicsStatsService.cpp
+++ b/services/core/jni/com_android_server_GraphicsStatsService.cpp
@@ -43,8 +43,9 @@ static void addToDump(JNIEnv* env, jobject, jlong dumpPtr, jstring jpath, jstrin
     std::string path;
     const ProfileData* data = nullptr;
     LOG_ALWAYS_FATAL_IF(jdata == nullptr && jpath == nullptr, "Path and data can't both be null");
+    ScopedByteArrayRO buffer{env};
     if (jdata != nullptr) {
-        ScopedByteArrayRO buffer(env, jdata);
+        buffer.reset(jdata);
         LOG_ALWAYS_FATAL_IF(buffer.size() != sizeof(ProfileData),
                 "Buffer size %zu doesn't match expected %zu!", buffer.size(), sizeof(ProfileData));
         data = reinterpret_cast<const ProfileData*>(buffer.get());