Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fdc129d9 authored by Ravneet Dhanjal's avatar Ravneet Dhanjal
Browse files

Camera: Fix use-after-free bug in Camera3OutputStream 

- The call to Camera3IOStreamBase::returnAnyBufferLocked can
result in Camera3OutputStream's destruction. This can cause
a use-after-free error when the calling function continues
execution to update the member variables.
- This fix uses an sp to keep the stream in scope for the
call to returnBuffer

Test: Camera CTS
Bug: 420614424
Flag: EXEMPT bug fix
Change-Id: Ib25a4683fd25a78a21ee7d20d4a5d0d2a4a7e087
parent ffaeb38a

services/camera/libcameraservice/device3/Camera3OutputUtils.cpp

+9 −3
Original line number Diff line number Diff line
@@ -946,9 +946,15 @@ void collectReturnableOutputBuffers( 
void finishReturningOutputBuffers(const std::vector<BufferToReturn> &returnableBuffers,

        sp<NotificationListener> listener, SessionStatsBuilder& sessionStatsBuilder) {

    for (auto& b : returnableBuffers) {

        const int streamId = b.stream->getId();

        sp<Camera3StreamInterface> stream(b.stream);

        if (stream == nullptr) {

            ALOGW("Cannot return buffer to null stream.");

            continue;

        }



        const int streamId = stream->getId();



        status_t res = b.stream->returnBuffer(b.buffer, b.timestamp,

        status_t res = stream->returnBuffer(b.buffer, b.timestamp,

                b.readoutTimestamp, b.timestampIncreasing,

                b.surfaceIds, b.resultExtras.frameNumber, b.transform);
@@ -979,7 +985,7 @@ void finishReturningOutputBuffers(const std::vector<BufferToReturn> &returnableB 
            // cancel the buffer

            camera_stream_buffer_t sb = b.buffer;

            sb.status = CAMERA_BUFFER_STATUS_ERROR;

            b.stream->returnBuffer(sb, /*timestamp*/0, /*readoutTimestamp*/0,

            stream->returnBuffer(sb, /*timestamp*/0, /*readoutTimestamp*/0,

                    b.timestampIncreasing, std::vector<size_t> (),

                    b.resultExtras.frameNumber, b.transform);