Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b861016d authored by Avichal Rakesh's avatar Avichal Rakesh
Browse files

cameraservice: handle invalid native_handle from vndk impl 

Cameraservice creates a H2BGraphicBufferProducer from a
native_handle_t. However, for native_handles that don't originate
from AImageReader_getWindowNativeHandle, the conversion returns
a nullptr. If this value is not checked, this results in cameraservice
crashing further down the stack.

This CL add a nullptr check and skips adding the IGBP if the
native_handle is malformed or invalid.

Bug: 309752167
Test: Verified by partner
Change-Id: I2e853f55d32f3cfe2fa51781f4eb87ee3de6607a
parent 6e7e4e4a

services/camera/libcameraservice/aidl/AidlUtils.cpp

+7 −1
Original line number Diff line number Diff line
@@ -78,7 +78,13 @@ UOutputConfiguration convertFromAidl(const SOutputConfiguration &src) { 


    for (auto &handle : windowHandles) {

        native_handle_t* nh = makeFromAidl(handle);

        iGBPs.push_back(new H2BGraphicBufferProducer(AImageReader_getHGBPFromHandle(nh)));

        auto igbp = AImageReader_getHGBPFromHandle(nh);

        if (igbp == nullptr) {

            ALOGE("%s: Could not get HGBP from NativeHandle: %s. Skipping.",

                    __FUNCTION__, handle.toString().c_str());

            continue;

        }

        iGBPs.push_back(new H2BGraphicBufferProducer(igbp));

        native_handle_delete(nh);

    }

    UOutputConfiguration outputConfiguration(

services/camera/libcameraservice/hidl/Utils.cpp

+7 −1
Original line number Diff line number Diff line
@@ -88,7 +88,13 @@ hardware::camera2::params::OutputConfiguration convertFromHidl( 
    auto &windowHandles = hOutputConfiguration.windowHandles;

    iGBPs.reserve(windowHandles.size());

    for (auto &handle : windowHandles) {

        iGBPs.push_back(new H2BGraphicBufferProducer(AImageReader_getHGBPFromHandle(handle)));

        auto igbp = AImageReader_getHGBPFromHandle(handle);

        if (igbp == nullptr) {

            ALOGE("%s: Could not get HGBP from native_handle: %p. Skipping.",

                    __FUNCTION__, handle.getNativeHandle());

            continue;

        }

        iGBPs.push_back(new H2BGraphicBufferProducer(igbp));

    }

    hardware::camera2::params::OutputConfiguration outputConfiguration(

        iGBPs, convertFromHidl(hOutputConfiguration.rotation),