Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 611526fd authored by Steve Kondik's avatar Steve Kondik
Browse files

camera: Fix the heap corruption issue 

 * Add locking around flatten/unflatten because they alter mMap and
   all hope and sleep is lost if it changes while we're iterating.
 * It's even worse if the memory backing the params string changes
   underneath of us :(

Change-Id: I06d85343a4a1c0143fab0687fda9e1d95a28440e
parent a2786b13

camera/CameraParameters.cpp

+8 −1
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include <string.h>

#include <stdlib.h>

#include <camera/CameraParameters.h>

#include <utils/threads.h>



namespace android {

// Parameter keys to communicate between camera application and driver.
@@ -100,7 +101,7 @@ const char CameraParameters::KEY_SUPPORTED_SCENE_MODES[] = "scene-mode-values"; 
#ifdef QCOM_HARDWARE

const char CameraParameters::KEY_SCENE_DETECT[] = "scene-detect";

const char CameraParameters::KEY_SUPPORTED_SCENE_DETECT[] = "scene-detect-values";

#endif QCOM_HARDWARE

#endif // QCOM_HARDWARE

const char CameraParameters::KEY_FLASH_MODE[] = "flash-mode";

const char CameraParameters::KEY_SUPPORTED_FLASH_MODES[] = "flash-mode-values";

const char CameraParameters::KEY_FOCUS_MODE[] = "focus-mode";
@@ -515,6 +516,8 @@ const char CameraParameters::SCENE_MODE_TEXT[] = "text"; 
static const char* portrait = "portrait";

static const char* landscape = "landscape";



static Mutex gCameraParamsLock;



int CameraParameters::getOrientation() const

{

    const char* orientation = get("orientation");
@@ -548,6 +551,8 @@ CameraParameters::~CameraParameters() 


String8 CameraParameters::flatten() const

{

    Mutex::Autolock lock(gCameraParamsLock);



    String8 flattened("");

    size_t size = mMap.size();
@@ -568,6 +573,8 @@ String8 CameraParameters::flatten() const 


void CameraParameters::unflatten(const String8 &params)

{

    Mutex::Autolock lock(gCameraParamsLock);



    const char *a = params.string();

    const char *b;