diff options
| author | Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2021-06-28 09:41:27 +0300 |
|---|---|---|
| committer | Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2021-06-28 10:51:57 +0300 |
| commit | 1684c3f930b2a27884037bc38856477b80cddd50 (patch) | |
| tree | 3e7863e68ec264c9de48906b97ef55388650ce83 | |
| parent | d3fef998444c21142fa12b9bf698a73ee5706fd6 (diff) | |
android: camera_device: Fix null pointer dereference
Commit 7532caa2c77b ("android: camera_device: Reset config_ if
Camera::configure() fails") reworked the configuration sequence to
ensure that the CameraConfiguration pointers gets reset when
configuration fails. This inadvertently causes a null pointer
dereference, as the CameraStream constructor accesses the camera
configuration through CameraDevice::cameraConfiguration() before the
internal config_ pointer is set.
Fix this by passing the configuration pointer explicitly to the
CameraStream constructor.
Fixes: 7532caa2c77b ("android: camera_device: Reset config_ if Camera::configure() fails")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
Tested-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Hirokazu Honda <hiroh@chromium.org>
| -rw-r--r-- | src/android/camera_device.cpp | 4 | ||||
| -rw-r--r-- | src/android/camera_device.h | 4 | ||||
| -rw-r--r-- | src/android/camera_stream.cpp | 6 | ||||
| -rw-r--r-- | src/android/camera_stream.h | 3 |
4 files changed, 7 insertions, 10 deletions
diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index 13ee5fab..678cde23 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -682,8 +682,8 @@ int CameraDevice::configureStreams(camera3_stream_configuration_t *stream_list) config->addConfiguration(streamConfig.config); for (auto &stream : streamConfig.streams) { - streams_.emplace_back(this, stream.type, stream.stream, - config->size() - 1); + streams_.emplace_back(this, config.get(), stream.type, + stream.stream, config->size() - 1); stream.stream->priv = static_cast<void *>(&streams_.back()); } } diff --git a/src/android/camera_device.h b/src/android/camera_device.h index 18cf5118..3361918d 100644 --- a/src/android/camera_device.h +++ b/src/android/camera_device.h @@ -48,10 +48,6 @@ public: unsigned int id() const { return id_; } camera3_device_t *camera3Device() { return &camera3Device_; } const std::shared_ptr<libcamera::Camera> &camera() const { return camera_; } - libcamera::CameraConfiguration *cameraConfiguration() const - { - return config_.get(); - } const std::string &maker() const { return maker_; } const std::string &model() const { return model_; } diff --git a/src/android/camera_stream.cpp b/src/android/camera_stream.cpp index b2f03b50..bf4a7b41 100644 --- a/src/android/camera_stream.cpp +++ b/src/android/camera_stream.cpp @@ -39,10 +39,10 @@ LOG_DECLARE_CATEGORY(HAL) * and buffer allocation. */ -CameraStream::CameraStream(CameraDevice *const cameraDevice, Type type, +CameraStream::CameraStream(CameraDevice *const cameraDevice, + CameraConfiguration *config, Type type, camera3_stream_t *camera3Stream, unsigned int index) - : cameraDevice_(cameraDevice), - config_(cameraDevice->cameraConfiguration()), type_(type), + : cameraDevice_(cameraDevice), config_(config), type_(type), camera3Stream_(camera3Stream), index_(index) { if (type_ == Type::Internal || type_ == Type::Mapped) { diff --git a/src/android/camera_stream.h b/src/android/camera_stream.h index 34016722..8ecc6e34 100644 --- a/src/android/camera_stream.h +++ b/src/android/camera_stream.h @@ -110,7 +110,8 @@ public: Internal, Mapped, }; - CameraStream(CameraDevice *const cameraDevice, Type type, + CameraStream(CameraDevice *const cameraDevice, + libcamera::CameraConfiguration *config, Type type, camera3_stream_t *camera3Stream, unsigned int index); Type type() const { return type_; } |