commit 42f2707bb2d9698765d1180787ffc890c41ddb3a
author Chien-Yu Chen <cychen@google.com> Mon Jan 11 17:39:17 2016 -0800
committer Chien-Yu Chen <cychen@google.com> Thu Mar 17 11:32:12 2016 -0700
tree 9c9c511293153db9af6907684e88993d1ffc17b0
parent b53ab34b95b8633070cbef5d03162d182aac3a9a

Camera: validate input in releaseRecordingFrame

Check mem isn't null before using it in releaseRecordingFrame.

Bug: 26164272
Change-Id: I384d4aa2798b6121ae548a6bb618fc0189f96633

services/camera/libcameraservice/api1/CameraClient.cpp

diff --git a/services/camera/libcameraservice/api1/CameraClient.cpp b/services/camera/libcameraservice/api1/CameraClient.cpp
index 37f4c8f..1086340 100644
--- a/services/camera/libcameraservice/api1/CameraClient.cpp
+++ b/services/camera/libcameraservice/api1/CameraClient.cpp
@@ -479,6 +479,12 @@
 void CameraClient::releaseRecordingFrame(const sp<IMemory>& mem) {
     Mutex::Autolock lock(mLock);
     if (checkPidAndHardware() != NO_ERROR) return;
+    if (mem == nullptr) {
+        android_errorWriteWithInfoLog(CameraService::SN_EVENT_LOG_ID, "26164272",
+                IPCThreadState::self()->getCallingUid(), nullptr, 0);
+        return;
+    }
+
     mHardware->releaseRecordingFrame(mem);
 }