Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26e2b325 authored by Cliff Wu's avatar Cliff Wu Committed by Android (Google) Code Review
Browse files

Merge "Fix the crash of deallocate caused by delete array error on storeInjectionConfig()"

parents 0b27f196 d047631c

services/camera/libcameraservice/device3/Camera3Device.h

+3 −0
Original line number Diff line number Diff line
@@ -1430,6 +1430,9 @@ class Camera3Device : 
        // Copy the configuration of the internal camera.

        camera3::camera_stream_configuration mInjectionConfig;



        // Copy the streams of the internal camera.

        Vector<camera3::camera_stream_t*> mInjectionStreams;



        // Copy the bufferSizes of the output streams of the internal camera.

        std::vector<uint32_t> mInjectionBufferSizes;

services/camera/libcameraservice/device3/Camera3DeviceInjectionMethods.cpp

+6 −12
Original line number Diff line number Diff line
@@ -193,11 +193,6 @@ status_t Camera3Device::Camera3DeviceInjectionMethods::injectCamera( 


status_t Camera3Device::Camera3DeviceInjectionMethods::stopInjection() {

    status_t res = NO_ERROR;

    mIsStreamConfigCompleteButNotInjected = false;

    if (mInjectionConfig.streams != nullptr) {

        delete [] mInjectionConfig.streams;

        mInjectionConfig.streams = nullptr;

    }



    sp<Camera3Device> parent = mParent.promote();

    if (parent == nullptr) {
@@ -269,16 +264,12 @@ void Camera3Device::Camera3DeviceInjectionMethods::storeInjectionConfig( 
        const camera3::camera_stream_configuration& injectionConfig,

        const std::vector<uint32_t>& injectionBufferSizes) {

    mIsStreamConfigCompleteButNotInjected = true;

    if (mInjectionConfig.streams != nullptr) {

        delete [] mInjectionConfig.streams;

        mInjectionConfig.streams = nullptr;

    }

    mInjectionConfig = injectionConfig;

    mInjectionConfig.streams =

        (android::camera3::camera_stream_t **) new camera_stream_t*[injectionConfig.num_streams];

    mInjectionStreams.clear();

    for (size_t i = 0; i < injectionConfig.num_streams; i++) {

        mInjectionConfig.streams[i] = injectionConfig.streams[i];

        mInjectionStreams.push_back(injectionConfig.streams[i]);

    }

    mInjectionConfig.streams = mInjectionStreams.editArray();

    mInjectionBufferSizes = injectionBufferSizes;

}
@@ -359,6 +350,9 @@ status_t Camera3Device::Camera3DeviceInjectionMethods::injectionConfigureStreams 
void Camera3Device::Camera3DeviceInjectionMethods::injectionDisconnectImpl() {

    ATRACE_CALL();

    ALOGI("%s: Injection camera disconnect", __FUNCTION__);

    mIsStreamConfigCompleteButNotInjected = false;

    mInjectionStreams.clear();

    mInjectionConfig.streams = nullptr;



    mBackupHalInterface = nullptr;

    HalInterface* interface = nullptr;