commit 23d2a2e07a38589ab054ad8e143cf92126d4b10b
author Ray Essick <essick@google.com> Mon Jul 10 20:59:36 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 10 20:59:36 2017 +0000
tree 39c858f8e973cc965ce0ef6d53216aace55e1eef
parent f34e3f272d9ca267b73188ec7cb6c40ef27682ec
parent fb3d950fe608b32137de8e13fdb9e85c89f9c6e6

Merge "Check frame handle validity before freeing buffer." into oc-dev am: c9d2ceb9c2 am: 7983d30105
am: fb3d950fe6

Change-Id: I1debf75171d081e5ab7c03da5354ed32f9d608ff

media/libstagefright/CameraSource.cpp

diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
index 61a2b5f..6ed0d0e 100644
--- a/media/libstagefright/CameraSource.cpp
+++ b/media/libstagefright/CameraSource.cpp
@@ -972,6 +972,14 @@
         }
 
         if (handle != nullptr) {
+            ssize_t offset;
+            size_t size;
+            sp<IMemoryHeap> heap = frame->getMemory(&offset, &size);
+            if (heap->getHeapID() != mMemoryHeapBase->getHeapID()) {
+                ALOGE("%s: Mismatched heap ID, ignoring release (got %x, expected %x)",
+		     __FUNCTION__, heap->getHeapID(), mMemoryHeapBase->getHeapID());
+                return;
+            }
             uint32_t batchSize = 0;
             {
                 Mutex::Autolock autoLock(mBatchLock);