summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEino-Ville Talvala <etalvala@google.com>2017-02-01 15:27:41 -0800
committerSean McCreary <mccreary@mcwest.org>2017-04-05 18:33:30 -0600
commitc59a656f9923a0e2fc308dabc373594e88b345d1 (patch)
tree7588d5478c604969fdd904350834a7dce9b5d768
parente9598179f3e286a58e8222a3654701b330cd5268 (diff)
downloadframeworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.zip
frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.gz
frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.bz2
CameraBase: Don't return an sp<> by reference
If the server dies, the binder death callback clears out the global camera service sp<>, and any current references to it will become quite unhappy. Test: Camera CTS passes Bug: 31992879 AOSP-Change-Id: I2966bed35d0319e3f26e3d4b1b8dc08006a22348 CVE-2017-0544 Change-Id: Ib7ef455366927b0471f8fcabdd5a54e38e375d41 (cherry picked from commit 4b49489c12e6862e9a320ebcb53872e809ed20ec)
-rw-r--r--camera/CameraBase.cpp10
-rw-r--r--include/camera/CameraBase.h2
2 files changed, 6 insertions, 6 deletions
diff --git a/camera/CameraBase.cpp b/camera/CameraBase.cpp
index 5d50aa8..871dcea 100644
--- a/camera/CameraBase.cpp
+++ b/camera/CameraBase.cpp
@@ -65,7 +65,7 @@ namespace {
// establish binder interface to camera service
template <typename TCam, typename TCamTraits>
-const sp<ICameraService>& CameraBase<TCam, TCamTraits>::getCameraService()
+const sp<ICameraService> CameraBase<TCam, TCamTraits>::getCameraService()
{
Mutex::Autolock _l(gLock);
if (gCameraService.get() == 0) {
@@ -98,7 +98,7 @@ sp<TCam> CameraBase<TCam, TCamTraits>::connect(int cameraId,
sp<TCam> c = new TCam(cameraId);
sp<TCamCallbacks> cl = c;
status_t status = NO_ERROR;
- const sp<ICameraService>& cs = getCameraService();
+ const sp<ICameraService> cs = getCameraService();
if (cs != 0) {
TCamConnectService fnConnectService = TCamTraits::fnConnectService;
@@ -195,7 +195,7 @@ int CameraBase<TCam, TCamTraits>::getNumberOfCameras() {
template <typename TCam, typename TCamTraits>
status_t CameraBase<TCam, TCamTraits>::getCameraInfo(int cameraId,
struct CameraInfo* cameraInfo) {
- const sp<ICameraService>& cs = getCameraService();
+ const sp<ICameraService> cs = getCameraService();
if (cs == 0) return UNKNOWN_ERROR;
return cs->getCameraInfo(cameraId, cameraInfo);
}
@@ -203,7 +203,7 @@ status_t CameraBase<TCam, TCamTraits>::getCameraInfo(int cameraId,
template <typename TCam, typename TCamTraits>
status_t CameraBase<TCam, TCamTraits>::addServiceListener(
const sp<ICameraServiceListener>& listener) {
- const sp<ICameraService>& cs = getCameraService();
+ const sp<ICameraService> cs = getCameraService();
if (cs == 0) return UNKNOWN_ERROR;
return cs->addListener(listener);
}
@@ -211,7 +211,7 @@ status_t CameraBase<TCam, TCamTraits>::addServiceListener(
template <typename TCam, typename TCamTraits>
status_t CameraBase<TCam, TCamTraits>::removeServiceListener(
const sp<ICameraServiceListener>& listener) {
- const sp<ICameraService>& cs = getCameraService();
+ const sp<ICameraService> cs = getCameraService();
if (cs == 0) return UNKNOWN_ERROR;
return cs->removeListener(listener);
}
diff --git a/include/camera/CameraBase.h b/include/camera/CameraBase.h
index 1b93157..4c849de 100644
--- a/include/camera/CameraBase.h
+++ b/include/camera/CameraBase.h
@@ -101,7 +101,7 @@ protected:
virtual void binderDied(const wp<IBinder>& who);
// helper function to obtain camera service handle
- static const sp<ICameraService>& getCameraService();
+ static const sp<ICameraService> getCameraService();
sp<TCamUser> mCamera;
status_t mStatus;