Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix potential double destroy of AssetManager

Browse Source 
Assume there is a XmlBlock [X] created by a AssetManager [A]
([A] will have mNumRefs = 2). After [A].close is called
(mNumRefs = 1) and then both [X] and [A] are going to be GCed,
if [A].finalize is called first (nativeDestroy), the later
[X].finalize will invoke [A].xmlBlockGone that triggers the
second nativeDestroy of [A] and leads to crash.

By clearing the mObject in AssetManager.finalize, the
decRefsLocked from other paths won't call nativeDestroy again.

Bug: 144028297
Test: atest android.security.cts.AssetManagerTest

Change-Id: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Merged-In: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
This commit is contained in:
Ryan Mitchell
2020-01-15 11:43:47 -08:00
parent 5e0b069876
commit 93320661ca
1 changed files with 39 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
core/java/android/content/res/AssetManager.java
View File

@@ -68,24 +68,24 @@ public final class AssetManager implements AutoCloseable {
private static final String TAG = "AssetManager";
private static final boolean localLOGV = false || false;
private static final boolean DEBUG_REFS = false;
private static final Object sSync = new Object();
/*package*/ static AssetManager sSystem = null;
private final TypedValue mValue = new TypedValue();
private final long[] mOffsets = new long[2];
// For communication with native code.
private long mObject;
private StringBlock mStringBlocks[] = null;
private int mNumRefs = 1;
private boolean mOpen = true;
private HashMap<Long, RuntimeException> mRefStacks;
/**
* Create a new AssetManager containing only the basic system assets.
* Applications will not generally use this method, instead retrieving the
@@ -114,7 +114,7 @@ public final class AssetManager implements AutoCloseable {
}
}
}
private AssetManager(boolean isSystem) {
if (DEBUG_REFS) {
synchronized (this) {
@@ -337,10 +337,10 @@ public final class AssetManager implements AutoCloseable {
* Open an asset using ACCESS_STREAMING mode. This provides access to
* files that have been bundled with an application as assets -- that is,
* files placed in to the "assets" directory.
*
*
* @param fileName The name of the asset to open. This name can be
* hierarchical.
*
*
* @see #open(String, int)
* @see #list
*/
@@ -353,11 +353,11 @@ public final class AssetManager implements AutoCloseable {
* read its contents. This provides access to files that have been bundled
* with an application as assets -- that is, files placed in to the
* "assets" directory.
*
*
* @param fileName The name of the asset to open. This name can be
* hierarchical.
* @param accessMode Desired access mode for retrieving the data.
*
*
* @see #ACCESS_UNKNOWN
* @see #ACCESS_STREAMING
* @see #ACCESS_RANDOM
@@ -397,14 +397,14 @@ public final class AssetManager implements AutoCloseable {
/**
* Return a String array of all the assets at the given path.
*
*
* @param path A relative path within the assets, i.e., "docs/home.html".
*
*
* @return String[] Array of strings, one for each asset. These file
* names are relative to 'path'. You can open the file by
* concatenating 'path' and a name in the returned string (via
* File) and passing that to open().
*
*
* @see #open
*/
public native final String[] list(String path)
@@ -416,7 +416,7 @@ public final class AssetManager implements AutoCloseable {
* provides direct access to all of the files included in an application
* package (not only its assets). Applications should not normally use
* this.
*
*
* @see #open(String)
*/
public final InputStream openNonAsset(String fileName) throws IOException {
@@ -429,7 +429,7 @@ public final class AssetManager implements AutoCloseable {
* provides direct access to all of the files included in an application
* package (not only its assets). Applications should not normally use
* this.
*
*
* @see #open(String, int)
*/
public final InputStream openNonAsset(String fileName, int accessMode)
@@ -440,7 +440,7 @@ public final class AssetManager implements AutoCloseable {
/**
* {@hide}
* Open a non-asset in a specified package. Not for use by applications.
*
*
* @param cookie Identifier of the package to be opened.
* @param fileName Name of the asset to retrieve.
*/
@@ -452,7 +452,7 @@ public final class AssetManager implements AutoCloseable {
/**
* {@hide}
* Open a non-asset in a specified package. Not for use by applications.
*
*
* @param cookie Identifier of the package to be opened.
* @param fileName Name of the asset to retrieve.
* @param accessMode Desired access mode for retrieving the data.
@@ -477,7 +477,7 @@ public final class AssetManager implements AutoCloseable {
throws IOException {
return openNonAssetFd(0, fileName);
}
public final AssetFileDescriptor openNonAssetFd(int cookie,
String fileName) throws IOException {
synchronized (this) {
@@ -492,20 +492,20 @@ public final class AssetManager implements AutoCloseable {
}
throw new FileNotFoundException("Asset absolute file: " + fileName);
}
/**
* Retrieve a parser for a compiled XML file.
*
*
* @param fileName The name of the file to retrieve.
*/
public final XmlResourceParser openXmlResourceParser(String fileName)
throws IOException {
return openXmlResourceParser(0, fileName);
}
/**
* Retrieve a parser for a compiled XML file.
*
*
* @param cookie Identifier of the package to be opened.
* @param fileName The name of the file to retrieve.
*/
@@ -521,7 +521,7 @@ public final class AssetManager implements AutoCloseable {
* {@hide}
* Retrieve a non-asset as a compiled XML file. Not for use by
* applications.
*
*
* @param fileName The name of the file to retrieve.
*/
/*package*/ final XmlBlock openXmlBlockAsset(String fileName)
@@ -533,7 +533,7 @@ public final class AssetManager implements AutoCloseable {
* {@hide}
* Retrieve a non-asset as a compiled XML file. Not for use by
* applications.
*
*
* @param cookie Identifier of the package to be opened.
* @param fileName Name of the asset to retrieve.
*/
@@ -588,12 +588,18 @@ public final class AssetManager implements AutoCloseable {
}
}
}
destroy();
synchronized (this) {
if (mObject != 0) {
destroy();
mObject = 0;
}
}
} finally {
super.finalize();
}
}
public final class AssetInputStream extends InputStream {
/**
* @hide
@@ -796,7 +802,7 @@ public final class AssetManager implements AutoCloseable {
/*package*/ native final String getResourcePackageName(int resid);
/*package*/ native final String getResourceTypeName(int resid);
/*package*/ native final String getResourceEntryName(int resid);
private native final long openAsset(String fileName, int accessMode);
private final native ParcelFileDescriptor openAssetFd(String fileName,
long[] outOffsets) throws IOException;
@@ -856,17 +862,17 @@ public final class AssetManager implements AutoCloseable {
* {@hide}
*/
public native static final int getGlobalAssetCount();
/**
* {@hide}
*/
public native static final String getAssetAllocations();
/**
* {@hide}
*/
public native static final int getGlobalAssetManagerCount();
private native final long newTheme();
private native final void deleteTheme(long theme);
/*package*/ native static final void applyThemeStyle(long theme, int styleRes, boolean force);
@@ -899,7 +905,7 @@ public final class AssetManager implements AutoCloseable {
}
mNumRefs++;
}
private final void decRefsLocked(long id) {
if (DEBUG_REFS && mRefStacks != null) {
mRefStacks.remove(id);
@@ -907,8 +913,9 @@ public final class AssetManager implements AutoCloseable {
mNumRefs--;
//System.out.println("Dec streams: mNumRefs=" + mNumRefs
// + " mReleased=" + mReleased);
if (mNumRefs == 0) {
if (mNumRefs == 0 && mObject != 0) {
destroy();
mObject = 0;
}
}
}