diff options
| author | Chien-Yu Chen <cychen@google.com> | 2016-03-09 12:21:01 -0800 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-03-25 17:46:45 -0700 |
| commit | b04aee833c5cfb6b31b8558350feb14bb1a0f353 (patch) | |
| tree | 7c2d2f9e70830bc5db8485d6feb96ad5d4f487a8 /services | |
| parent | f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba (diff) | |
| download | frameworks_av-b04aee833c5cfb6b31b8558350feb14bb1a0f353.zip frameworks_av-b04aee833c5cfb6b31b8558350feb14bb1a0f353.tar.gz frameworks_av-b04aee833c5cfb6b31b8558350feb14bb1a0f353.tar.bz2 | |
Camera3Device: Validate template ID
Validate template ID before creating a default request.
Bug: 26866110
Bug: 27568958
Change-Id: Ifda457024f1d5c2b1382f189c1a8d5fda852d30d
Diffstat (limited to 'services')
| -rw-r--r-- | services/camera/libcameraservice/device3/Camera3Device.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp index 50d9d75..8b43154 100644 --- a/services/camera/libcameraservice/device3/Camera3Device.cpp +++ b/services/camera/libcameraservice/device3/Camera3Device.cpp @@ -43,6 +43,7 @@ #include <utils/Trace.h> #include <utils/Timers.h> +#include "CameraService.h" #include "utils/CameraTraces.h" #include "mediautils/SchedulingPolicyService.h" #include "device3/Camera3Device.h" @@ -1115,6 +1116,13 @@ status_t Camera3Device::createDefaultRequest(int templateId, CameraMetadata *request) { ATRACE_CALL(); ALOGV("%s: for template %d", __FUNCTION__, templateId); + + if (templateId <= 0 || templateId >= CAMERA3_TEMPLATE_COUNT) { + android_errorWriteWithInfoLog(CameraService::SN_EVENT_LOG_ID, "26866110", + IPCThreadState::self()->getCallingUid(), NULL, 0); + return BAD_VALUE; + } + Mutex::Autolock il(mInterfaceLock); Mutex::Autolock l(mLock); |