diff options
| author | Eino-Ville Talvala <etalvala@google.com> | 2017-02-01 15:27:41 -0800 |
|---|---|---|
| committer | Sean McCreary <mccreary@mcwest.org> | 2017-04-05 18:33:30 -0600 |
| commit | c59a656f9923a0e2fc308dabc373594e88b345d1 (patch) | |
| tree | 7588d5478c604969fdd904350834a7dce9b5d768 /include/camera | |
| parent | e9598179f3e286a58e8222a3654701b330cd5268 (diff) | |
| download | frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.zip frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.gz frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.bz2 | |
CameraBase: Don't return an sp<> by reference
If the server dies, the binder death callback clears out
the global camera service sp<>, and any current references to it
will become quite unhappy.
Test: Camera CTS passes
Bug: 31992879
AOSP-Change-Id: I2966bed35d0319e3f26e3d4b1b8dc08006a22348
CVE-2017-0544
Change-Id: Ib7ef455366927b0471f8fcabdd5a54e38e375d41
(cherry picked from commit 4b49489c12e6862e9a320ebcb53872e809ed20ec)
Diffstat (limited to 'include/camera')
| -rw-r--r-- | include/camera/CameraBase.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/camera/CameraBase.h b/include/camera/CameraBase.h index 1b93157..4c849de 100644 --- a/include/camera/CameraBase.h +++ b/include/camera/CameraBase.h @@ -101,7 +101,7 @@ protected: virtual void binderDied(const wp<IBinder>& who); // helper function to obtain camera service handle - static const sp<ICameraService>& getCameraService(); + static const sp<ICameraService> getCameraService(); sp<TCamUser> mCamera; status_t mStatus; |