commit 299ffc94df55c3bab416c6ec2bdc8ef10d3c1d7c
author Binhao Lin <binhaol@codeaurora.org> Thu Apr 27 11:22:47 2017 -0700
committer Shuzhen Wang <shuzhenwang@google.com> Fri Apr 28 19:02:40 2017 -0700
tree be6d64cfefe8b7f080b0f7fe367b5928d6ec4a82
parent fb4e3d4bb0f423750949a5f6518f800f05f01c3e

QCamera2: HAL3: Fix double free bug

Previous patch for SYNC_FRAME_NUMBER had a bug where some reprocessing requests could cause double free.

Bug: 36655894
Change-Id: I932189bc474dd09aa006fdc55e5eade71c7d0c9a

msm8998/QCamera2/HAL3/QCamera3HWI.cpp

diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
index bff3b1b..1e8d70f 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
@@ -4473,13 +4473,15 @@
             LOGD("Internal Request drop the result");
         } else {
             if (result->result != NULL) {
-                CameraMetadata metadata;
-                metadata.acquire((camera_metadata_t *)result->result);
-                if (metadata.exists(ANDROID_SYNC_FRAME_NUMBER)) {
+                camera_metadata_t *metadata = const_cast<camera_metadata_t*>(result->result);
+                camera_metadata_entry_t entry;
+                int ret = find_camera_metadata_entry(metadata, ANDROID_SYNC_FRAME_NUMBER, &entry);
+                if (ret == OK) {
                     int64_t sync_frame_number = frameworkFrameNumber;
-                    metadata.update(ANDROID_SYNC_FRAME_NUMBER, &sync_frame_number, 1);
+                    ret = update_camera_metadata_entry(metadata, entry.index, &sync_frame_number, 1, &entry);
+                    if (ret != OK)
+                        LOGE("Update ANDROID_SYNC_FRAME_NUMBER Error!");
                 }
-                result->result = metadata.release();
             }
             result->frame_number = frameworkFrameNumber;
             mCallbackOps->process_capture_result(mCallbackOps, result);