From f3a10cd2445ed535e519abb0206b47028dcf8ae2 Mon Sep 17 00:00:00 2001
From: Eric Laurent <elaurent@google.com>
Date: Mon, 20 Apr 2020 12:49:25 -0700
Subject: [PATCH] AudioManager: fix event handler

Fix access by reference to listener list outside of
synchronized block by cloning the list.

Bug: 154341343
Test: AudioPolicyTest#testAudioPorts, AudioManagerTest#testVolumeGroupCallback, AudioRoutingTest
Change-Id: I1f0fd62c1894dc0dbb07b01f2fd78899e48b4932
---
 media/java/android/media/AudioPortEventHandler.java            | 3 ++-
 .../media/audiopolicy/AudioVolumeGroupChangeHandler.java       | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/media/java/android/media/AudioPortEventHandler.java b/media/java/android/media/AudioPortEventHandler.java
index 14249cbe89454..8e8dfaf24b9a3 100644
--- a/media/java/android/media/AudioPortEventHandler.java
+++ b/media/java/android/media/AudioPortEventHandler.java
@@ -78,7 +78,8 @@ class AudioPortEventHandler {
                                     listeners.add((AudioManager.OnAudioPortUpdateListener)msg.obj);
                                 }
                             } else {
-                                listeners = mListeners;
+                                listeners = (ArrayList<AudioManager.OnAudioPortUpdateListener>)
+                                        mListeners.clone();
                             }
                         }
                         // reset audio port cache if the event corresponds to a change coming
diff --git a/media/java/android/media/audiopolicy/AudioVolumeGroupChangeHandler.java b/media/java/android/media/audiopolicy/AudioVolumeGroupChangeHandler.java
index adf4d3dcfa098..022cfeeb4e43e 100644
--- a/media/java/android/media/audiopolicy/AudioVolumeGroupChangeHandler.java
+++ b/media/java/android/media/audiopolicy/AudioVolumeGroupChangeHandler.java
@@ -80,7 +80,8 @@ public class AudioVolumeGroupChangeHandler {
                                         (AudioManager.VolumeGroupCallback) msg.obj);
                             }
                         } else {
-                            listeners = mListeners;
+                            listeners = (ArrayList<AudioManager.VolumeGroupCallback>)
+                                    mListeners.clone();
                         }
                     }
                     if (listeners.isEmpty()) {