libbinder: onBinder* respect termination
Previously, these would leak binder objects if transactions occurred on
already terminated RpcState objects.
Fixes: 189345133
Test: binder_parcel_fuzzer (w/ leak repro), binderRpcTest
Change-Id: I68f86bf0656dd316691634d4fc411e6cac361449
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 9795348..d19b4d8 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -283,9 +283,10 @@
if (isNull & 1) {
auto addr = RpcAddress::zero();
- status_t status = addr.readFromParcel(*this);
- if (status != OK) return status;
- binder = mSession->state()->onBinderEntering(mSession, addr);
+ if (status_t status = addr.readFromParcel(*this); status != OK) return status;
+ if (status_t status = mSession->state()->onBinderEntering(mSession, addr, &binder);
+ status != OK)
+ return status;
}
return finishUnflattenBinder(binder, out);