commit e992e75053e98e3699af6e344c11b787e30411ad
author Eino-Ville Talvala <etalvala@google.com> Fri Nov 07 16:17:48 2014 -0800
committer Eino-Ville Talvala <etalvala@google.com> Fri Nov 07 16:32:55 2014 -0800
tree c0a88c5e09f9f4a7fdcb56eda9c60497124bf783
parent e1a2df553a6d151807a5da738a3cd853bef908d9

Camera: Guard against asBinder() calls on NULL interfaces

Bug: 18207548
Change-Id: I9879c9b4c0282a6b96b77398f62beedc47f7f0a0

services/camera/libcameraservice/api2/CameraDeviceClient.cpp

diff --git a/services/camera/libcameraservice/api2/CameraDeviceClient.cpp b/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
index e3301aa..c6d62e7 100644
--- a/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
+++ b/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
@@ -42,8 +42,14 @@
         int clientPid,
         uid_t clientUid,
         int servicePid) :
-    BasicClient(cameraService, remoteCallback->asBinder(), clientPackageName,
-                cameraId, cameraFacing, clientPid, clientUid, servicePid),
+    BasicClient(cameraService,
+            remoteCallback != NULL ? remoteCallback->asBinder() : NULL,
+            clientPackageName,
+            cameraId,
+            cameraFacing,
+            clientPid,
+            clientUid,
+            servicePid),
     mRemoteCallback(remoteCallback) {
 }
 
@@ -353,12 +359,8 @@
         useAsync = true;
     }
 
-    sp<IBinder> binder;
-    sp<ANativeWindow> anw;
-    if (bufferProducer != 0) {
-        binder = bufferProducer->asBinder();
-        anw = new Surface(bufferProducer, useAsync);
-    }
+    sp<IBinder> binder = bufferProducer->asBinder();
+    sp<ANativeWindow> anw = new Surface(bufferProducer, useAsync);
 
     // TODO: remove w,h,f since we are ignoring them
 
@@ -395,7 +397,7 @@
     res = mDevice->createStream(anw, width, height, format, &streamId);
 
     if (res == OK) {
-        mStreamMap.add(bufferProducer->asBinder(), streamId);
+        mStreamMap.add(binder, streamId);
 
         ALOGV("%s: Camera %d: Successfully created a new stream ID %d",
               __FUNCTION__, mCameraId, streamId);
@@ -514,7 +516,8 @@
     String8 result;
     result.appendFormat("CameraDeviceClient[%d] (%p) dump:\n",
             mCameraId,
-            getRemoteCallback()->asBinder().get());
+            (getRemoteCallback() != NULL ?
+                    getRemoteCallback()->asBinder().get() : NULL) );
     result.appendFormat("  Current client: %s (PID %d, UID %u)\n",
             String8(mClientPackageName).string(),
             mClientPid, mClientUid);