Fix crash caused by Use after free

b/329330347
youtube · Mar 14, 2024 · c88ef38 · c88ef38
1 parent c65b33a
commit c88ef38
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 11 deletions.
diff --git a/cobalt/media_session/media_session_client.cc b/cobalt/media_session/media_session_client.cc
@@ -327,20 +327,18 @@ void MediaSessionClient::OnMediaSessionStateChanged(
       artist = metadata.artist();
       title = metadata.title();
       if (artwork_size > 0) {
-        const MediaImageSequence& artwork(metadata.artwork());
+        const MediaImageSequence& artwork = metadata.artwork();
         for (MediaImageSequence::size_type i = 0; i < artwork_size; i++) {
-          const MediaImage& media_image(artwork.at(i));
-          CobaltExtensionMediaImage ext_image;
-          ext_image.src = media_image.src().c_str();
-          if (ext_image.src == nullptr) {
+          const MediaImage& media_image = artwork.at(i);
+          ext_artwork[i].src = std::string(media_image.src()).c_str();
+          if (ext_artwork[i].src == nullptr) {
             // src() is required, but Cobalt IDL parser doesn't enforce it.
             // See cobalt/media_session/media_image.idl for more info.
             // https://wicg.github.io/mediasession/#dictdef-mediaimage
             LOG(ERROR) << "Required src string for MediaImage is missing.";
           }
-          ext_image.size = media_image.sizes().c_str();
-          ext_image.type = media_image.type().c_str();
-          ext_artwork[i] = ext_image;
+          ext_artwork[i].size = std::string(media_image.sizes()).c_str();
+          ext_artwork[i].type = std::string(media_image.type()).c_str();
         }
       }
     }

diff --git a/starboard/android/shared/android_media_session_client.cc b/starboard/android/shared/android_media_session_client.cc
@@ -186,15 +186,15 @@ void OnMediaSessionStateChanged(
   ScopedLocalJavaRef<jobjectArray> j_artwork;
 
   if (session_state.metadata != NULL) {
-    CobaltExtensionMediaMetadata* media_metadata(session_state.metadata);
+    const CobaltExtensionMediaMetadata* media_metadata = session_state.metadata;
 
     j_title.Reset(env->NewStringStandardUTFOrAbort(media_metadata->title));
     j_artist.Reset(env->NewStringStandardUTFOrAbort(media_metadata->artist));
     j_album.Reset(env->NewStringStandardUTFOrAbort(media_metadata->album));
 
     size_t artwork_count = media_metadata->artwork_count;
     if (artwork_count > 0) {
-      CobaltExtensionMediaImage* artwork(media_metadata->artwork);
+      const CobaltExtensionMediaImage* artwork = media_metadata->artwork;
       ScopedLocalJavaRef<jclass> media_image_class(
           env->FindClassExtOrAbort("dev/cobalt/media/MediaImage"));
       jmethodID media_image_constructor = env->GetMethodID(
@@ -210,7 +210,7 @@ void OnMediaSessionStateChanged(
       ScopedLocalJavaRef<jstring> j_sizes;
       ScopedLocalJavaRef<jstring> j_type;
       for (size_t i = 0; i < artwork_count; i++) {
-        const CobaltExtensionMediaImage& media_image(artwork[i]);
+        const CobaltExtensionMediaImage& media_image = artwork[i];
         j_src.Reset(env->NewStringStandardUTFOrAbort(media_image.src));
         j_sizes.Reset(env->NewStringStandardUTFOrAbort(media_image.size));
         j_type.Reset(env->NewStringStandardUTFOrAbort(media_image.type));