diff options
| author | Yin-Chia Yeh <yinchiayeh@google.com> | 2020-03-16 11:35:25 -0700 |
|---|---|---|
| committer | Yin-Chia Yeh <yinchiayeh@google.com> | 2020-04-06 17:10:31 +0000 |
| commit | cbbd7e06ac322f5f5e373be23379d06c10082864 (patch) | |
| tree | 8edbc85b977a3b36a36adae7e882a7088e7d8fc3 | |
| parent | 687d14d2fe23b87c584b41b01f24e3f2596baf18 (diff) | |
| download | frameworks_av-cbbd7e06ac322f5f5e373be23379d06c10082864.tar.gz frameworks_av-cbbd7e06ac322f5f5e373be23379d06c10082864.tar.bz2 frameworks_av-cbbd7e06ac322f5f5e373be23379d06c10082864.zip | |
RESTRICT AUTOMERGE: Camera: fix use after free in sensor timestamp
The metadata object might be overriden later and has it memory
re-allocated; hence snaping the sensor timestamp value before
we call into any method that might change the metadata.
Test: build
Bug: 150944913
Merged-In: I0f944fc9133d3ab279859f20236d956d7ca338f8
Change-Id: I5b10b680e0cce96ca49e1772770adb4835545472
| -rw-r--r-- | services/camera/libcameraservice/device3/Camera3Device.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp index 4227a3b9de..93e18cfee3 100644 --- a/services/camera/libcameraservice/device3/Camera3Device.cpp +++ b/services/camera/libcameraservice/device3/Camera3Device.cpp @@ -3529,6 +3529,8 @@ void Camera3Device::sendCaptureResult(CameraMetadata &pendingMetadata, frameNumber); return; } + nsecs_t sensorTimestamp = timestamp.data.i64[0]; + for (auto& physicalMetadata : captureResult.mPhysicalMetadatas) { camera_metadata_entry timestamp = physicalMetadata.mPhysicalCameraMetadata.find(ANDROID_SENSOR_TIMESTAMP); @@ -3583,7 +3585,7 @@ void Camera3Device::sendCaptureResult(CameraMetadata &pendingMetadata, CameraMetadata(m.mPhysicalCameraMetadata)); } mTagMonitor.monitorMetadata(TagMonitor::RESULT, - frameNumber, timestamp.data.i64[0], captureResult.mMetadata, + frameNumber, sensorTimestamp, captureResult.mMetadata, monitoredPhysicalMetadata); insertResultLocked(&captureResult, frameNumber); |