commit 9cd140240c84789d00349c33e9c0b7a74d1543ed
author Chien-Yu Chen <cychen@google.com> Wed Mar 09 12:21:01 2016 -0800
committer Chien-Yu Chen <cychen@google.com> Wed Mar 09 14:55:14 2016 -0800
tree 80baad1161cbdd72fd3d12c7730a45ae6a30524b
parent 9322ba85a06ae149575ab102dc9bcffb4388cc7e

Camera3Device: Validate template ID

Validate template ID before creating a default request.

Bug: 26866110
Change-Id: Ifda457024f1d5c2b1382f189c1a8d5fda852d30d

services/camera/libcameraservice/device3/Camera3Device.cpp

diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index ee84ff0..dfbe200 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -1237,6 +1237,13 @@
         CameraMetadata *request) {
     ATRACE_CALL();
     ALOGV("%s: for template %d", __FUNCTION__, templateId);
+
+    if (templateId <= 0 || templateId >= CAMERA3_TEMPLATE_COUNT) {
+        android_errorWriteWithInfoLog(CameraService::SN_EVENT_LOG_ID, "26866110",
+                IPCThreadState::self()->getCallingUid(), nullptr, 0);
+        return BAD_VALUE;
+    }
+
     Mutex::Autolock il(mInterfaceLock);
     Mutex::Autolock l(mLock);