Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c530c597 authored by Yin-Chia Yeh's avatar Yin-Chia Yeh
Browse files

Camera: fix use after free in sensor timestamp 

The metadata object might be overriden later and has it memory
re-allocated; hence snaping the sensor timestamp value before
we call into any method that might change the metadata.

Test: build
Bug: 150944913
Merged-In: I0f944fc9133d3ab279859f20236d956d7ca338f8
Change-Id: I0f944fc9133d3ab279859f20236d956d7ca338f8
(cherry picked from commit 60afc2fd)
parent 90334d0f

services/camera/libcameraservice/device3/Camera3OutputUtils.cpp

+3 −1
Original line number Original line Diff line number Diff line
@@ -246,6 +246,8 @@ void sendCaptureResult( 
                frameNumber);

                frameNumber);

        return;

        return;

    }

    }

    nsecs_t sensorTimestamp = timestamp.data.i64[0];



    for (auto& physicalMetadata : captureResult.mPhysicalMetadatas) {

    for (auto& physicalMetadata : captureResult.mPhysicalMetadatas) {

        camera_metadata_entry timestamp =

        camera_metadata_entry timestamp =

                physicalMetadata.mPhysicalCameraMetadata.find(ANDROID_SENSOR_TIMESTAMP);

                physicalMetadata.mPhysicalCameraMetadata.find(ANDROID_SENSOR_TIMESTAMP);
@@ -337,7 +339,7 @@ void sendCaptureResult( 
                CameraMetadata(m.mPhysicalCameraMetadata));

                CameraMetadata(m.mPhysicalCameraMetadata));

    }

    }

    states.tagMonitor.monitorMetadata(TagMonitor::RESULT,

    states.tagMonitor.monitorMetadata(TagMonitor::RESULT,

            frameNumber, timestamp.data.i64[0], captureResult.mMetadata,

            frameNumber, sensorTimestamp, captureResult.mMetadata,

            monitoredPhysicalMetadata);

            monitoredPhysicalMetadata);





    insertResultLocked(states, &captureResult, frameNumber);

    insertResultLocked(states, &captureResult, frameNumber);