Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79eb99a1 authored by Ravneet's avatar Ravneet
Browse files

Camera: Fix use after free bug in vendor cache 

- Rearrange order in setting the global vendor cache to
prevent decStrong from deleting the prior reference to cache
upon globalVendorTagDescCache reassignment so that vendor_cache_ops
in camera metadata can remain valid
- Add same fix to setting global vendor desc to prevent
issues with vendor_tag_ops access

Test: Validity test
Bug: 231526212
Change-Id: I8f7a7f29d05fc25ab1cff42f342446ccb6194d26
parent a32bd3bd

camera/VendorTagDescriptor.cpp

+6 −2
Original line number Diff line number Diff line
@@ -598,7 +598,6 @@ status_t VendorTagDescriptor::createDescriptorFromOps(const vendor_tag_ops_t* vO 
status_t VendorTagDescriptor::setAsGlobalVendorTagDescriptor(const sp<VendorTagDescriptor>& desc) {

    status_t res = OK;

    Mutex::Autolock al(sLock);

    sGlobalVendorTagDescriptor = desc;



    vendor_tag_ops_t* opsPtr = NULL;

    if (desc != NULL) {
@@ -613,6 +612,9 @@ status_t VendorTagDescriptor::setAsGlobalVendorTagDescriptor(const sp<VendorTagD 
        ALOGE("%s: Could not set vendor tag descriptor, received error %s (%d)."

                , __FUNCTION__, strerror(-res), res);

    }



    sGlobalVendorTagDescriptor = desc;



    return res;

}
@@ -631,7 +633,6 @@ status_t VendorTagDescriptorCache::setAsGlobalVendorTagCache( 
        const sp<VendorTagDescriptorCache>& cache) {

    status_t res = OK;

    Mutex::Autolock al(sLock);

    sGlobalVendorTagDescriptorCache = cache;



    struct vendor_tag_cache_ops* opsPtr = NULL;

    if (cache != NULL) {
@@ -646,6 +647,9 @@ status_t VendorTagDescriptorCache::setAsGlobalVendorTagCache( 
        ALOGE("%s: Could not set vendor tag cache, received error %s (%d)."

                , __FUNCTION__, strerror(-res), res);

    }



    sGlobalVendorTagDescriptorCache = cache;



    return res;

}