commit 41779c4849d0edfd72c784fdbd4de92784056ee7
author Ray Essick <essick@google.com> Mon Jul 10 20:50:36 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 10 20:50:36 2017 +0000
tree d093c11d9e27128557bc82b28da6c0802421a8d8
parent 15fb0ee6bd752ccde960b961dd1e9113c37e5f8b
parent c9d2ceb9c270aadffe905fc0f6556c5736626825

Merge "Check frame handle validity before freeing buffer." into oc-dev
am: c9d2ceb9c2

Change-Id: I8d1dafc03a9a4bd9fdae836361298c9bf7890df3

media/libstagefright/CameraSource.cpp

diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
index 61a2b5f..6ed0d0e 100644
--- a/media/libstagefright/CameraSource.cpp
+++ b/media/libstagefright/CameraSource.cpp
@@ -972,6 +972,14 @@
         }
 
         if (handle != nullptr) {
+            ssize_t offset;
+            size_t size;
+            sp<IMemoryHeap> heap = frame->getMemory(&offset, &size);
+            if (heap->getHeapID() != mMemoryHeapBase->getHeapID()) {
+                ALOGE("%s: Mismatched heap ID, ignoring release (got %x, expected %x)",
+		     __FUNCTION__, heap->getHeapID(), mMemoryHeapBase->getHeapID());
+                return;
+            }
             uint32_t batchSize = 0;
             {
                 Mutex::Autolock autoLock(mBatchLock);