summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorEino-Ville Talvala <etalvala@google.com>2017-02-01 15:27:41 -0800
committerSean McCreary <mccreary@mcwest.org>2017-04-05 18:33:30 -0600
commitc59a656f9923a0e2fc308dabc373594e88b345d1 (patch)
tree7588d5478c604969fdd904350834a7dce9b5d768 /include
parente9598179f3e286a58e8222a3654701b330cd5268 (diff)
downloadframeworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.zip
frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.gz
frameworks_av-c59a656f9923a0e2fc308dabc373594e88b345d1.tar.bz2
CameraBase: Don't return an sp<> by reference
If the server dies, the binder death callback clears out the global camera service sp<>, and any current references to it will become quite unhappy. Test: Camera CTS passes Bug: 31992879 AOSP-Change-Id: I2966bed35d0319e3f26e3d4b1b8dc08006a22348 CVE-2017-0544 Change-Id: Ib7ef455366927b0471f8fcabdd5a54e38e375d41 (cherry picked from commit 4b49489c12e6862e9a320ebcb53872e809ed20ec)
Diffstat (limited to 'include')
-rw-r--r--include/camera/CameraBase.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/include/camera/CameraBase.h b/include/camera/CameraBase.h
index 1b93157..4c849de 100644
--- a/include/camera/CameraBase.h
+++ b/include/camera/CameraBase.h
@@ -101,7 +101,7 @@ protected:
virtual void binderDied(const wp<IBinder>& who);
// helper function to obtain camera service handle
- static const sp<ICameraService>& getCameraService();
+ static const sp<ICameraService> getCameraService();
sp<TCamUser> mCamera;
status_t mStatus;