commit 30302ea600604ea30bae4652cd8d18fb16ee84fa
author Chien-Yu Chen <cychen@google.com> Mon Mar 21 18:39:11 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Mar 21 18:39:11 2016 +0000
tree 2b0db72fd46fe983617f7b137510acc95aeea8fd
parent 6c2dac8aaadfc5c0b303114898899831c0d43aa2
parent a4996d9f0edece83bcb7ea85a8dae0e90a9221d1

Merge "Camera3Device: Validate template ID" into klp-dev am: ac5ef62 am: e57ada1 am: d6e3220 am: e2049c7 am: edcd8f9
am: a4996d9

* commit 'a4996d9f0edece83bcb7ea85a8dae0e90a9221d1':
  Camera3Device: Validate template ID

services/camera/libcameraservice/device3/Camera3Device.cpp

diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index 0c941fb..67bd22f 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -43,6 +43,7 @@
 #include <utils/Trace.h>
 #include <utils/Timers.h>
 
+#include "CameraService.h"
 #include "utils/CameraTraces.h"
 #include "device3/Camera3Device.h"
 #include "device3/Camera3OutputStream.h"
@@ -1093,6 +1094,13 @@
         CameraMetadata *request) {
     ATRACE_CALL();
     ALOGV("%s: for template %d", __FUNCTION__, templateId);
+
+    if (templateId <= 0 || templateId >= CAMERA3_TEMPLATE_COUNT) {
+        android_errorWriteWithInfoLog(CameraService::SN_EVENT_LOG_ID, "26866110",
+                IPCThreadState::self()->getCallingUid(), NULL, 0);
+        return BAD_VALUE;
+    }
+
     Mutex::Autolock il(mInterfaceLock);
     Mutex::Autolock l(mLock);