Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Simplify and fix handle free routine.

Previously, there was an out-of-array access if refCount was equal to
MAX_CONCURRENT_INSTANCES. While debugging this, I also simplified the
overly complicated code.

Change-Id: Ic6cf417c6d5dd9aeb39b6ae29783769366501b67
  • Loading branch information...
commit 95ae6baab701f5f4da380d113007d3a0ed184fa2 1 parent 9f1aa8c
@maniac103 maniac103 authored tpruvot committed
Showing with 15 additions and 33 deletions.
  1. +15 −33 omx/system/src/openmax_il/omx_core/src/OMX_Core.c
View
48 omx/system/src/openmax_il/omx_core/src/OMX_Core.c
@@ -371,41 +371,23 @@ OMX_ERRORTYPE TIOMX_FreeHandle (OMX_HANDLETYPE hComponent)
goto EXIT;
}
- int refIndex = 0, handleIndex = 0, shiftIndex=0;
- for (refIndex=0; refIndex < MAX_TABLE_SIZE; refIndex++) {
- for (handleIndex=0; handleIndex < componentTable[refIndex].refCount; handleIndex++){
+ int refIndex = 0, handleIndex = 0;
+ for (refIndex = 0; refIndex < MAX_TABLE_SIZE; refIndex++) {
+ ComponentTable *table = &componentTable[refIndex];
+
+ for (handleIndex = 0; handleIndex < table->refCount; handleIndex++) {
/* get the position for the component in the table */
- if (componentTable[refIndex].pHandle[handleIndex] == hComponent){
- LOGD("Found matching pHandle(%p) at index %d with refCount %d",
- hComponent, refIndex, componentTable[refIndex].refCount);
- if (componentTable[refIndex].refCount > 1) {
- /*There is more than one instance of the same component. The
- * instance to free can be ahead of the last one created, so the rest of the
- * instances will be shifted in the array*/
- if (handleIndex < componentTable[refIndex].refCount-1)
- {
- /*This instance is not the last one created */
- for (shiftIndex=handleIndex; shiftIndex < componentTable[refIndex].refCount;shiftIndex++)
- {
- if (componentTable[refIndex].pHandle[shiftIndex])
- {
- componentTable[refIndex].pHandle[shiftIndex]= componentTable[refIndex].pHandle[shiftIndex+1];
- componentTable[refIndex].pHandle[shiftIndex+1] = NULL;
- }
- }
- }
- else
- {
- /*This instance is the last one created */
- componentTable[refIndex].pHandle[handleIndex] = NULL;
- }
- componentTable[refIndex].refCount -= 1;
- }
- else
- {
- componentTable[refIndex].refCount -= 1;
- componentTable[refIndex].pHandle[handleIndex] = NULL;
+ if (table->pHandle[handleIndex] == hComponent) {
+ LOGD("Found matching pHandle(%p) at component %d with refCount %d, handle index %d",
+ hComponent, refIndex, table->refCount, handleIndex);
+
+ while (handleIndex < table->refCount && handleIndex < (MAX_CONCURRENT_INSTANCES - 1)) {
+ table->pHandle[handleIndex] = table->pHandle[handleIndex + 1];
+ handleIndex++;
}
+ table->refCount -= 1;
+ table->pHandle[table->refCount] = NULL;
+
dlclose(pModules[i]);
pModules[i] = NULL;
free(pComponents[i]);
Please sign in to comment.
Something went wrong with that request. Please try again.