Merge "Camera: Fix "use after free" for mOutstandingBuffers" into oc-dr1-dev (abb8fb7f) · Commits · e / os / android_frameworks_av

services/camera/libcameraservice/device3/Camera3Stream.cpp

+4 −2

Original line number	Diff line number	Diff line
		@@ -523,6 +523,8 @@ status_t Camera3Stream::returnBuffer(const camera3_stream_buffer &buffer,
		return BAD_VALUE;
		}

		removeOutstandingBuffer(buffer);

		/**
		* TODO: Check that the state is valid first.
		*
		@@ -540,7 +542,6 @@ status_t Camera3Stream::returnBuffer(const camera3_stream_buffer &buffer,
		// buffer to be returned.
		mOutputBufferReturnedSignal.signal();

		removeOutstandingBuffer(buffer);
		return res;
		}

		@@ -591,13 +592,14 @@ status_t Camera3Stream::returnInputBuffer(const camera3_stream_buffer &buffer) {
		return BAD_VALUE;
		}

		removeOutstandingBuffer(buffer);

		status_t res = returnInputBufferLocked(buffer);
		if (res == OK) {
		fireBufferListenersLocked(buffer, /acquired/false, /output/false);
		mInputBufferReturnedSignal.signal();
		}

		removeOutstandingBuffer(buffer);
		return res;
		}