commit da6c1ba14cca4fd72c3a0bccd074b9e3a487cb3e
author Ray Essick <essick@google.com> Mon Jul 10 20:55:06 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 10 20:55:06 2017 +0000
tree d770863589465a7bfcc84488c5591e0c61762df3
parent b2d55a72e0bf9e015aeff68b33f5b2e3dd3d1517
parent 41779c4849d0edfd72c784fdbd4de92784056ee7

Merge "Check frame handle validity before freeing buffer." into oc-dev am: c9d2ceb9c2
am: 41779c4849

Change-Id: I29926177d6e8c76ed715997d1e548ed18e569274

media/libstagefright/CameraSource.cpp

diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
index 61a2b5f..6ed0d0e 100644
--- a/media/libstagefright/CameraSource.cpp
+++ b/media/libstagefright/CameraSource.cpp
@@ -972,6 +972,14 @@
         }
 
         if (handle != nullptr) {
+            ssize_t offset;
+            size_t size;
+            sp<IMemoryHeap> heap = frame->getMemory(&offset, &size);
+            if (heap->getHeapID() != mMemoryHeapBase->getHeapID()) {
+                ALOGE("%s: Mismatched heap ID, ignoring release (got %x, expected %x)",
+		     __FUNCTION__, heap->getHeapID(), mMemoryHeapBase->getHeapID());
+                return;
+            }
             uint32_t batchSize = 0;
             {
                 Mutex::Autolock autoLock(mBatchLock);