Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81d75430 authored by Zhijun He's avatar Zhijun He Committed by Eino-Ville Talvala
Browse files

DO NOT MERGE: camera2/3: Add protection for still capture path 

Jpeg stream in JpegProcessor could be deleted while process new capture is
ongoing, which unsafe to access a dead consumer endpoint.
Bug: 9316454
Change-Id: I2950f31ea28d0ba01f08502e2e3ba452bf8bb818
parent 85b3013e

services/camera/libcameraservice/api1/client2/JpegProcessor.cpp

+44 −35
Original line number Diff line number Diff line
@@ -200,9 +200,17 @@ status_t JpegProcessor::processNewCapture() { 
    ATRACE_CALL();

    status_t res;

    sp<Camera2Heap> captureHeap;

    sp<MemoryBase> captureBuffer;



    CpuConsumer::LockedBuffer imgBuffer;



    {

        Mutex::Autolock l(mInputMutex);

        if (mCaptureStreamId == NO_STREAM) {

            ALOGW("%s: Camera %d: No stream is available", __FUNCTION__, mId);

            return INVALID_OPERATION;

        }



        res = mCaptureConsumer->lockNextBuffer(&imgBuffer);

        if (res != OK) {

            if (res != BAD_VALUE) {
@@ -239,11 +247,12 @@ status_t JpegProcessor::processNewCapture() { 
        }



        // TODO: Optimize this to avoid memcopy

    sp<MemoryBase> captureBuffer = new MemoryBase(mCaptureHeap, 0, jpegSize);

        captureBuffer = new MemoryBase(mCaptureHeap, 0, jpegSize);

        void* captureMemory = mCaptureHeap->getBase();

        memcpy(captureMemory, imgBuffer.data, jpegSize);



        mCaptureConsumer->unlockBuffer(imgBuffer);

    }



    sp<CaptureSequencer> sequencer = mSequencer.promote();

    if (sequencer != 0) {