commit 83f6d5af97060ad6e934ae4612b1bbb5c84c1abd
author Shuzhen Wang <shuzhenwang@google.com> Sat Jul 15 18:24:08 2017 +0000
committer android-build-merger <android-build-merger@google.com> Sat Jul 15 18:24:08 2017 +0000
tree ab57816b1c189d43463fabe682cc33e39633b579
parent c3619796d09d61d67762243d1bba112199874d4c
parent abb8fb7f78c68ae9a960c8e9107fe663da7ff709

Merge "Camera: Fix "use after free" for mOutstandingBuffers" into oc-dr1-dev am: af842eb79e
am: abb8fb7f78

Change-Id: I56ee5bb644259c375ea02720303c6348104a9181

services/camera/libcameraservice/device3/Camera3Stream.cpp

diff --git a/services/camera/libcameraservice/device3/Camera3Stream.cpp b/services/camera/libcameraservice/device3/Camera3Stream.cpp
index 9297ac8..6789292 100644
--- a/services/camera/libcameraservice/device3/Camera3Stream.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Stream.cpp
@@ -523,6 +523,8 @@
         return BAD_VALUE;
     }
 
+    removeOutstandingBuffer(buffer);
+
     /**
      * TODO: Check that the state is valid first.
      *
@@ -540,7 +542,6 @@
     // buffer to be returned.
     mOutputBufferReturnedSignal.signal();
 
-    removeOutstandingBuffer(buffer);
     return res;
 }
 
@@ -591,13 +592,14 @@
         return BAD_VALUE;
     }
 
+    removeOutstandingBuffer(buffer);
+
     status_t res = returnInputBufferLocked(buffer);
     if (res == OK) {
         fireBufferListenersLocked(buffer, /*acquired*/false, /*output*/false);
         mInputBufferReturnedSignal.signal();
     }
 
-    removeOutstandingBuffer(buffer);
     return res;
 }