cameraservice: handle invalid native_handle from vndk impl
Cameraservice creates a H2BGraphicBufferProducer from a
native_handle_t. However, for native_handles that don't originate
from AImageReader_getWindowNativeHandle, the conversion returns
a nullptr. If this value is not checked, this results in cameraservice
crashing further down the stack.
This CL add a nullptr check and skips adding the IGBP if the
native_handle is malformed or invalid.
Bug: 309752167
Test: Verified by partner
Change-Id: I2e853f55d32f3cfe2fa51781f4eb87ee3de6607a
diff --git a/services/camera/libcameraservice/aidl/AidlUtils.cpp b/services/camera/libcameraservice/aidl/AidlUtils.cpp
index 7291c5f..2225cfe 100644
--- a/services/camera/libcameraservice/aidl/AidlUtils.cpp
+++ b/services/camera/libcameraservice/aidl/AidlUtils.cpp
@@ -78,7 +78,13 @@
for (auto &handle : windowHandles) {
native_handle_t* nh = makeFromAidl(handle);
- iGBPs.push_back(new H2BGraphicBufferProducer(AImageReader_getHGBPFromHandle(nh)));
+ auto igbp = AImageReader_getHGBPFromHandle(nh);
+ if (igbp == nullptr) {
+ ALOGE("%s: Could not get HGBP from NativeHandle: %s. Skipping.",
+ __FUNCTION__, handle.toString().c_str());
+ continue;
+ }
+ iGBPs.push_back(new H2BGraphicBufferProducer(igbp));
native_handle_delete(nh);
}
UOutputConfiguration outputConfiguration(