android: camera_device: Fix null pointer dereference

Commit 7532caa2c77b ("android: camera_device: Reset config_ if
Camera::configure() fails") reworked the configuration sequence to
ensure that the CameraConfiguration pointers gets reset when
configuration fails. This inadvertently causes a null pointer
dereference, as the CameraStream constructor accesses the camera
configuration through CameraDevice::cameraConfiguration() before the
internal config_ pointer is set.

Fix this by passing the configuration pointer explicitly to the
CameraStream constructor.

Fixes: 7532caa2c77b ("android: camera_device: Reset config_ if Camera::configure() fails")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
Tested-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Hirokazu Honda <hiroh@chromium.org>

1 files changed, 2 insertions, 2 deletions

diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp
index 13ee5fab..678cde23 100644
--- a/src/android/camera_device.cpp
+++ b/src/android/camera_device.cpp
@@ -682,8 +682,8 @@ int CameraDevice::configureStreams(camera3_stream_configuration_t *stream_list)
 		config->addConfiguration(streamConfig.config);
 
 		for (auto &stream : streamConfig.streams) {
-			streams_.emplace_back(this, stream.type, stream.stream,
-					      config->size() - 1);
+			streams_.emplace_back(this, config.get(), stream.type,
+					      stream.stream, config->size() - 1);
 			stream.stream->priv = static_cast<void *>(&streams_.back());
 		}
 	}