CameraModule: fix getCameraInfo()

Remove mCameraCharacteristicsMap.

CameraModule kept a CameraMetadata in mCameraCharacteristicsMap
and kept its camera_metadata in mCameraInfoMap. When CameraMetadata
gets moved in mCameraCharacteristicsMap, it may clone a new
camera_metadata and free the old one. So the original
camera_metadata stored in mCameraCharacteristicsMap becomes invalid.

Bug: 22171288
Change-Id: Ia8e99fe42989946bc952ad23abb296aeac60da83

2 files changed, 15 insertions, 6 deletions

diff --git a/services/camera/libcameraservice/common/CameraModule.cpp b/services/camera/libcameraservice/common/CameraModule.cpp
index 85d4488..1ae01ae 100644
--- a/services/camera/libcameraservice/common/CameraModule.cpp
+++ b/services/camera/libcameraservice/common/CameraModule.cpp
@@ -154,6 +154,18 @@ CameraModule::CameraModule(camera_module_t *module) {
     mCameraInfoMap.setCapacity(getNumberOfCameras());
 }
 
+CameraModule::~CameraModule()
+{
+    while (mCameraInfoMap.size() > 0) {
+        camera_info cameraInfo = mCameraInfoMap.editValueAt(0);
+        if (cameraInfo.static_camera_characteristics != NULL) {
+            free_camera_metadata(
+                    const_cast<camera_metadata_t*>(cameraInfo.static_camera_characteristics));
+        }
+        mCameraInfoMap.removeItemsAt(0);
+    }
+}
+
 int CameraModule::init() {
     if (getModuleApiVersion() >= CAMERA_MODULE_API_VERSION_2_4 &&
             mModule->init != NULL) {
@@ -192,12 +204,9 @@ int CameraModule::getCameraInfo(int cameraId, struct camera_info *info) {
         CameraMetadata m;
         m = rawInfo.static_camera_characteristics;
         deriveCameraCharacteristicsKeys(rawInfo.device_version, m);
-        mCameraCharacteristicsMap.add(cameraId, m);
         cameraInfo = rawInfo;
-        cameraInfo.static_camera_characteristics =
-                mCameraCharacteristicsMap.valueFor(cameraId).getAndLock();
-        mCameraInfoMap.add(cameraId, cameraInfo);
-        index = mCameraInfoMap.indexOfKey(cameraId);
+        cameraInfo.static_camera_characteristics = m.release();
+        index = mCameraInfoMap.add(cameraId, cameraInfo);
     }
 
     assert(index != NAME_NOT_FOUND);
diff --git a/services/camera/libcameraservice/common/CameraModule.h b/services/camera/libcameraservice/common/CameraModule.h
index c21092e..36822c7 100644
--- a/services/camera/libcameraservice/common/CameraModule.h
+++ b/services/camera/libcameraservice/common/CameraModule.h
@@ -33,6 +33,7 @@ namespace android {
 class CameraModule {
 public:
     CameraModule(camera_module_t *module);
+    virtual ~CameraModule();
 
     // Must be called after construction
     // Returns OK on success, NO_INIT on failure
@@ -60,7 +61,6 @@ private:
 
     camera_module_t *mModule;
     KeyedVector<int, camera_info> mCameraInfoMap;
-    KeyedVector<int, CameraMetadata> mCameraCharacteristicsMap;
     Mutex mCameraInfoLock;
 };