Camera: Fix for HWAddressSanitizer tag mismatch.
In ACameraManager when binderDied is executed, iteration happens over
the mDeviceStatusMap to get the cameraId. This same map gets modified
in onStatusChangedLocked and also sometimes deleting the cameraId entry
if the new status is NOT_PRESENT. This causes crash while accessing
memory just deleted.
This change creates a list of cameraId which is then used during the
iteration in binderDied.
bug: 194808760
Test:
1.Run NativeCameraDeviceTest#testCameraDeviceOpenAndClose and kill
cameraserver process to trigger binderDied.Verified the logs that
cameraId is passed to onStatusChangedLock.
2.Camera cts test suite currently in progress on device.
Change-Id: Ib885941e0d0ca7c25d2172f6e1314bb7bef451b7
diff --git a/camera/ndk/impl/ACameraManager.cpp b/camera/ndk/impl/ACameraManager.cpp
index 95ef2b2..5892f1a 100644
--- a/camera/ndk/impl/ACameraManager.cpp
+++ b/camera/ndk/impl/ACameraManager.cpp
@@ -189,8 +189,12 @@
sp<CameraManagerGlobal> cm = mCameraManager.promote();
if (cm != nullptr) {
AutoMutex lock(cm->mLock);
+ std::vector<String8> cameraIdList;
for (auto& pair : cm->mDeviceStatusMap) {
- const String8 &cameraId = pair.first;
+ cameraIdList.push_back(pair.first);
+ }
+
+ for (String8 cameraId : cameraIdList) {
cm->onStatusChangedLocked(
CameraServiceListener::STATUS_NOT_PRESENT, cameraId);
}