Revert "HAL3: Fix a use-after-free bug"
This reverts commit abb47831f8898a3bfcbc42203092d87e2e1a4961.
diff --git a/msm8998/QCamera2/HAL3/QCamera3Channel.cpp b/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
index 53bdd25..0e3b4af 100644
--- a/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
@@ -4285,7 +4285,7 @@
int32_t QCamera3PicChannel::returnYuvBufferAndEncode(mm_camera_buf_def_t *frame,
buffer_handle_t *outBuffer, uint32_t frameNumber,
- std::shared_ptr<metadata_buffer_t> metadata, mm_camera_buf_def_t *metaFrame)
+ std::shared_ptr<metadata_buffer_t> metadata)
{
int32_t rc = OK;
@@ -4371,7 +4371,7 @@
metadataBuf->camera_handle = m_camHandle;
metadataBuf->ch_id = getMyHandle();
metadataBuf->num_bufs = 1;
- metadataBuf->bufs[0] = metaFrame;
+ metadataBuf->bufs[0] = (mm_camera_buf_def_t *)calloc(1, sizeof(mm_camera_buf_def_t));
metadataBuf->bufs[0]->buffer = metadata.get();
// Start processing the metadata
diff --git a/msm8998/QCamera2/HAL3/QCamera3Channel.h b/msm8998/QCamera2/HAL3/QCamera3Channel.h
index 762c037..11eb3d1 100644
--- a/msm8998/QCamera2/HAL3/QCamera3Channel.h
+++ b/msm8998/QCamera2/HAL3/QCamera3Channel.h
@@ -588,8 +588,7 @@
// Return a YUV buffer (from getYuvBufferForRequest) and request jpeg encoding.
int32_t returnYuvBufferAndEncode(mm_camera_buf_def_t *frame,
buffer_handle_t *outBuffer, uint32_t frameNumber,
- std::shared_ptr<metadata_buffer_t> metadata,
- mm_camera_buf_def_t *metaFrame);
+ std::shared_ptr<metadata_buffer_t> metadata);
// Return a YUV buffer (from getYuvBufferForRequest) without requesting jpeg encoding.
int32_t returnYuvBuffer(mm_camera_buf_def_t *frame);
diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
index 7803ff0..d7a432c 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
@@ -5735,6 +5735,7 @@
// Mark current timestamp for the new request
bufsForCurRequest.timestamp = systemTime(CLOCK_MONOTONIC);
bufsForCurRequest.av_timestamp = 0;
+ bufsForCurRequest.hdrplus = hdrPlusRequest;
if (hdrPlusRequest) {
// Save settings for this request.
@@ -16006,29 +16007,10 @@
}
if (channel == mPictureChannel) {
- android_errorWriteLog(0x534e4554, "150004253");
- // Keep a copy of outputBufferDef until the final JPEG buffer is
- // ready because the JPEG callback uses the mm_camera_buf_def_t
- // struct. The metaBufDef is stored in a shared_ptr to make sure
- // it's freed.
- std::shared_ptr<mm_camera_buf_def_t> metaBufDef =
- std::make_shared<mm_camera_buf_def_t>();
- {
- pthread_mutex_lock(&mMutex);
- for (auto& pendingBuffers : mPendingBuffersMap.mPendingBuffersInRequest) {
- if (pendingBuffers.frame_number == result->requestId) {
- pendingBuffers.mHdrplusInputBuf = outputBufferDef;
- pendingBuffers.mHdrplusInputMetaBuf = metaBufDef;
- break;
- }
- }
- pthread_mutex_unlock(&mMutex);
- }
-
// Return the buffer to pic channel for encoding.
mPictureChannel->returnYuvBufferAndEncode(outputBufferDef.get(),
frameworkOutputBuffer->buffer, result->requestId,
- halMetadata, metaBufDef.get());
+ halMetadata);
} else {
// Return the buffer to camera framework.
pthread_mutex_lock(&mMutex);
diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.h b/msm8998/QCamera2/HAL3/QCamera3HWI.h
index 1ee613b..d5cbfbf 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.h
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.h
@@ -128,8 +128,7 @@
nsecs_t timestamp;
nsecs_t av_timestamp;
List<PendingBufferInfo> mPendingBufferList;
- std::shared_ptr<mm_camera_buf_def_t> mHdrplusInputBuf;
- std::shared_ptr<mm_camera_buf_def_t> mHdrplusInputMetaBuf;
+ bool hdrplus;
} PendingBuffersInRequest;
class PendingBuffersMap {