darkkirb/android_device_lenovo_karate
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

QCamera2:mm-camera-channel:Added check for max value of cur_capture_idx.

Browse source 
Issue: In FLASH mode, while requesting superBuffers for 100 snapshots
      cur_capture_idx is increasing to more that MAX_CAPTURE_BATCH_NUM,
      so by derefrencing frameConfig.config to cur_capture_idx, stack
      memory is getting corrupted.

Solution: Checking for max value of cur_capture_idx before derefrencing
          frameConfig.config array to avoid writing in outOfBound index
          memory.

Change-Id: Icaea62be483b3ee97304441f7c9287b73496f09d
This commit is contained in:
Abhinav Sohane 2017-12-19 15:07:03 +05:30 committed by Isaac Chen
parent 26165a08a7
commit f34640b607
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
camera/QCamera2/stack/mm-camera-interface/src/mm_camera_channel.c
View file

@ -530,7 +530,7 @@ static void mm_channel_process_stream_buf(mm_camera_cmdcb_t * cmd_cb,
ch_obj->isConfigCapture = FALSE;
}
if (ch_obj->isConfigCapture) {
if (ch_obj->isConfigCapture && ch_obj->cur_capture_idx < MAX_CAPTURE_BATCH_NUM) {
if (ch_obj->frameConfig.configs[ch_obj->cur_capture_idx].num_frames != 0) {
ch_obj->frameConfig.configs[ch_obj->cur_capture_idx].num_frames--;
} else {