mm-video: vdec: avoid set metadata after free buffer
In some use cases client frees output buffers before it gets
all FBD's, in this process component clears output buffer
structures it has for current session. Code dependent on
these structures results in crash if it executes after free
buffer. This change checks for such condition and avoids
the same.
CRs-fixed: 614669
Change-Id: Ia2b76425ebc49721beae2f02f5677d18dbff90a2
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index 39e952c..c16f85f 100644
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -4030,7 +4030,7 @@
else if (extn_equals(paramName, "OMX.google.android.index.storeMetaDataInBuffers")) {
*indexType = (OMX_INDEXTYPE)OMX_QcomIndexParamVideoMetaBufferMode;
}
-#if ADAPTIVE_PLAYBACK_SUPPORTED
+#ifdef ADAPTIVE_PLAYBACK_SUPPORTED
else if (extn_equals(paramName, "OMX.google.android.index.prepareForAdaptivePlayback")) {
*indexType = (OMX_INDEXTYPE)OMX_QcomIndexParamVideoAdaptivePlaybackMode;
}
@@ -6729,12 +6729,14 @@
}
#ifdef ADAPTIVE_PLAYBACK_SUPPORTED
- if (m_smoothstreaming_mode) {
+ if (m_smoothstreaming_mode && m_out_mem_ptr) {
OMX_U32 buf_index = buffer - m_out_mem_ptr;
BufferDim_t dim;
+ private_handle_t *private_handle = NULL;
dim.sliceWidth = drv_ctx.video_resolution.frame_width;
dim.sliceHeight = drv_ctx.video_resolution.frame_height;
- private_handle_t *private_handle = native_buffer[buf_index].privatehandle;
+ if (native_buffer[buf_index].privatehandle)
+ private_handle = native_buffer[buf_index].privatehandle;
if (private_handle) {
DEBUG_PRINT_LOW("set metadata: update buf-geometry with stride %d slice %d",
dim.sliceWidth, dim.sliceHeight);