am 0bbf8b21: camera2: Fix fuzztesting segfault in connect. (b500dc94) · Commits · e / os / android_frameworks_av

services/camera/libcameraservice/CameraService.cpp

+14 −2

Original line number	Diff line number	Diff line
		@@ -890,7 +890,10 @@ status_t CameraService::handleEvictionsLocked(const String8& cameraId, int clien
		if (current != nullptr) {
		auto clientSp = current->getValue();
		if (clientSp.get() != nullptr) { // should never be needed
		if (clientSp->getRemote() == remoteCallback) {
		if (!clientSp->canCastToApiClient(effectiveApiLevel)) {
		ALOGW("CameraService connect called from same client, but with a different"
		" API level, evicting prior client...");
		} else if (clientSp->getRemote() == remoteCallback) {
		ALOGI("CameraService::connect X (PID %d) (second call from same"
		" app binder, returning the same client)", clientPid);
		*client = clientSp;
		@@ -1754,6 +1757,11 @@ int CameraService::BasicClient::getClientPid() const {
		return mClientPid;
		}

		bool CameraService::BasicClient::canCastToApiClient(apiLevel level) const {
		// Defaults to API2.
		return level == API_2;
		}

		status_t CameraService::BasicClient::startCameraOps() {
		int32_t res;
		// Notify app ops that the camera is not available
		@@ -1866,6 +1874,10 @@ void CameraService::Client::disconnect() {
		BasicClient::disconnect();
		}

		bool CameraService::Client::canCastToApiClient(apiLevel level) const {
		return level == API_1;
		}

		CameraService::Client::OpsCallback::OpsCallback(wp<BasicClient> client):
		mClient(client) {
		}

+9 −0

Original line number	Diff line number	Diff line
		@@ -65,6 +65,7 @@ public:
		class Client;
		class BasicClient;

		// The effective API level. The Camera2 API running in LEGACY mode counts as API_1.
		enum apiLevel {
		API_1 = 1,
		API_2 = 2
		@@ -215,6 +216,10 @@ public:

		// Get the PID of the application client using this
		virtual int getClientPid() const;

		// Check what API level is used for this client. This is used to determine which
		// superclass this can be cast to.
		virtual bool canCastToApiClient(apiLevel level) const;
		protected:
		BasicClient(const sp<CameraService>& cameraService,
		const sp<IBinder>& remoteCallback,
		@@ -323,6 +328,10 @@ public:

		virtual void notifyError(ICameraDeviceCallbacks::CameraErrorCode errorCode,
		const CaptureResultExtras& resultExtras);

		// Check what API level is used for this client. This is used to determine which
		// superclass this can be cast to.
		virtual bool canCastToApiClient(apiLevel level) const;
		protected:
		// Convert client from cookie.
		static sp<CameraService::Client> getClientFromCookie(void* user);