commit c9d2ceb9c270aadffe905fc0f6556c5736626825
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Jul 10 20:43:39 2017 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Jul 10 20:43:39 2017 +0000
tree 64cb625c05b75ca03f1b4bc01d304c122f2cd905
parent b4bec13dca8d0a3077c411bd0455e6267ac4aad4
parent 7eb18466d9ee817ae1087ddc895902e8eae05535

Merge "Check frame handle validity before freeing buffer." into oc-dev

media/libstagefright/CameraSource.cpp

diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
index a569f5d..1cd7693 100644
--- a/media/libstagefright/CameraSource.cpp
+++ b/media/libstagefright/CameraSource.cpp
@@ -970,6 +970,14 @@
         }
 
         if (handle != nullptr) {
+            ssize_t offset;
+            size_t size;
+            sp<IMemoryHeap> heap = frame->getMemory(&offset, &size);
+            if (heap->getHeapID() != mMemoryHeapBase->getHeapID()) {
+                ALOGE("%s: Mismatched heap ID, ignoring release (got %x, expected %x)",
+		     __FUNCTION__, heap->getHeapID(), mMemoryHeapBase->getHeapID());
+                return;
+            }
             uint32_t batchSize = 0;
             {
                 Mutex::Autolock autoLock(mBatchLock);