Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1fa4142e authored by Avichal Rakesh's avatar Avichal Rakesh
Browse files

ExternalCameraHAL: Fix memory leak when copying buffer fence 

Pointer to native_handle_t created using native_handle_create should
be cleaned up using native_handle_delete even if the fds in the
native_handle is no longer managed by it. ExternalCameraDeviceSession
creates native_handle_t as an intermediate to convert to AIDL
NativeHandle but doesn't call native_handle_delete on the
intermediate object which led to memory leaks.

This CL removes the intermediate object and copies the fence fd
directly.

Bug: 305638723
Test: No functional change. Compilation successful.
Change-Id: Ie3c558ee1ae6d2e84053b65eed7db179118395bb
parent 25335354

camera/device/default/ExternalCameraDeviceSession.cpp

+8 −12
Original line number Diff line number Diff line
@@ -786,9 +786,8 @@ Status ExternalCameraDeviceSession::switchToOffline( 
                outputBuffer.bufferId = buffer.bufferId;

                outputBuffer.status = BufferStatus::ERROR;

                if (buffer.acquireFence >= 0) {

                    native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);

                    handle->data[0] = buffer.acquireFence;

                    outputBuffer.releaseFence = android::makeToAidl(handle);

                    outputBuffer.releaseFence.fds.resize(1);

                    outputBuffer.releaseFence.fds.at(0).set(buffer.acquireFence);

                }

            } else {

                offlineBuffers.push_back(buffer);
@@ -1769,9 +1768,8 @@ Status ExternalCameraDeviceSession::processCaptureRequestError( 
        result.outputBuffers[i].bufferId = req->buffers[i].bufferId;

        result.outputBuffers[i].status = BufferStatus::ERROR;

        if (req->buffers[i].acquireFence >= 0) {

            native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);

            handle->data[0] = req->buffers[i].acquireFence;

            result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle);

            result.outputBuffers[i].releaseFence.fds.resize(1);

            result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence);

        }

    }
@@ -1815,18 +1813,16 @@ Status ExternalCameraDeviceSession::processCaptureResult(std::shared_ptr<HalRequ 
        if (req->buffers[i].fenceTimeout) {

            result.outputBuffers[i].status = BufferStatus::ERROR;

            if (req->buffers[i].acquireFence >= 0) {

                native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);

                handle->data[0] = req->buffers[i].acquireFence;

                result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle);

                result.outputBuffers[i].releaseFence.fds.resize(1);

                result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence);

            }

            notifyError(req->frameNumber, req->buffers[i].streamId, ErrorCode::ERROR_BUFFER);

        } else {

            result.outputBuffers[i].status = BufferStatus::OK;

            // TODO: refactor

            if (req->buffers[i].acquireFence >= 0) {

                native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);

                handle->data[0] = req->buffers[i].acquireFence;

                result.outputBuffers[i].releaseFence = ::android::makeToAidl(handle);

                result.outputBuffers[i].releaseFence.fds.resize(1);

                result.outputBuffers[i].releaseFence.fds.at(0).set(req->buffers[i].acquireFence);

            }

        }

    }