diff options
| author | Yin-Chia Yeh <yinchiayeh@google.com> | 2020-03-16 11:35:25 -0700 |
|---|---|---|
| committer | Yin-Chia Yeh <yinchiayeh@google.com> | 2020-03-17 16:28:18 +0000 |
| commit | 00c275670b12bb1c610a998bbc4f3db204464f45 (patch) | |
| tree | 610cead8b9bf1ff5114cbd6405e3f7246fd356ea | |
| parent | 886419a51c28003ad27ff89a9fcd0a4b3230df81 (diff) | |
| download | frameworks_av-00c275670b12bb1c610a998bbc4f3db204464f45.tar.gz frameworks_av-00c275670b12bb1c610a998bbc4f3db204464f45.tar.bz2 frameworks_av-00c275670b12bb1c610a998bbc4f3db204464f45.zip | |
RESTRICT AUTOMERGE: Camera: fix use after free in sensor timestamp
The metadata object might be overriden later and has it memory
re-allocated; hence snaping the sensor timestamp value before
we call into any method that might change the metadata.
Test: build
Bug: 150944913
Merged-In: I0f944fc9133d3ab279859f20236d956d7ca338f8
Change-Id: I5b10b680e0cce96ca49e1772770adb4835545472
| -rw-r--r-- | services/camera/libcameraservice/device3/Camera3Device.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp index a8e80fa560..e347127a58 100644 --- a/services/camera/libcameraservice/device3/Camera3Device.cpp +++ b/services/camera/libcameraservice/device3/Camera3Device.cpp @@ -3521,6 +3521,8 @@ void Camera3Device::sendCaptureResult(CameraMetadata &pendingMetadata, frameNumber); return; } + nsecs_t sensorTimestamp = timestamp.data.i64[0]; + for (auto& physicalMetadata : captureResult.mPhysicalMetadatas) { camera_metadata_entry timestamp = physicalMetadata.mPhysicalCameraMetadata.find(ANDROID_SENSOR_TIMESTAMP); @@ -3575,7 +3577,7 @@ void Camera3Device::sendCaptureResult(CameraMetadata &pendingMetadata, CameraMetadata(m.mPhysicalCameraMetadata)); } mTagMonitor.monitorMetadata(TagMonitor::RESULT, - frameNumber, timestamp.data.i64[0], captureResult.mMetadata, + frameNumber, sensorTimestamp, captureResult.mMetadata, monitoredPhysicalMetadata); insertResultLocked(&captureResult, frameNumber); |