Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d343e3d5 authored by Mathias Agopian's avatar Mathias Agopian
Browse files

fix [2515291] Native crash and runtime restart while trying to preview captured picture on Sapphire 

if a buffer couldn't be allocated because of an OOM, SF could, in some case dereference
a null pointer.

Change-Id: I5321248c38a21e56d5278b6aada2694e64451378
parent 80586f42

libs/surfaceflinger/Layer.cpp

+48 −31
Original line number Diff line number Diff line
@@ -466,14 +466,24 @@ void Layer::lockPageFlip(bool& recomputeVisibleRegions) 
        return;

    }



    // ouch, this really should never happen

    if (uint32_t(buf)>=NUM_BUFFERS) {

        LOGE("retireAndLock() buffer index (%d) out of range", buf);

        mPostedDirtyRegion.clear();

        return;

    }



    // we retired a buffer, which becomes the new front buffer

    mFrontBufferIndex = buf;



    // get the dirty region

    sp<GraphicBuffer> newFrontBuffer(getBuffer(buf));

    if (newFrontBuffer != NULL) {

        // compute the posted region

        const Region dirty(lcblk->getDirtyRegion(buf));

        mPostedDirtyRegion = dirty.intersect( newFrontBuffer->getBounds() );



        // update the layer size and release freeze-lock

        const Layer::State& front(drawingState());

        if (newFrontBuffer->getWidth()  == front.requested_w &&

            newFrontBuffer->getHeight() == front.requested_h)
@@ -504,6 +514,13 @@ void Layer::lockPageFlip(bool& recomputeVisibleRegions) 
            // we now have the correct size, unfreeze the screen

            mFreezeLock.clear();

        }

    } else {

        // this should not happen unless we ran out of memory while

        // allocating the buffer. we're hoping that things will get back

        // to normal the next time the app tries to draw into this buffer.

        // meanwhile, pretend the screen didn't update.

        mPostedDirtyRegion.clear();

    }



    if (lcblk->getQueuedCount()) {

        // signal an event if we have more buffers waiting