Fixed a use-after-free in exo::Pointer

Basically you can get the UAF by binding to either one of the delegates
twice.  Naturally (as a comment suggested) this doesnt make much sense,
but its still an attack surface so this fix will stop it.

The fix means that if a user binds the delegate's interface twice, then
we will only keep the latest one alive, and we simulate removal of the
pointer interface for the other (which prevents it from invoking methods
on that pointer during its destruction).

Bug: b:135720248
Change-Id: I39f4ca1602058efa650a51a41e3ce7b955bb43bd
Commit-Queue: Nic Hollingum <>
Reviewed-by: Mitsuru Oshima <>
Cr-Commit-Position: refs/heads/master@{#671568}
1 file changed