CameraHal: Add error handling during frame callbacks

- ST can be abandoned by the client, so we
  need to handle this case inside 'handleFrameCallback'
  without crashing.
- 'freeBufferList()' should only release buffers
  associated with it.

Change-Id: Ib052aa6a6c2b5cb495d4e8bcc804cd3a3b87c95f
Signed-off-by: Emilian Peev <epeev@mm-sol.com>
Signed-off-by: Vladimir Petrov <vppetrov@mm-sol.com>

1 files changed, 15 insertions, 6 deletions

diff --git a/camera/BufferSourceAdapter.cpp b/camera/BufferSourceAdapter.cpp
index 7d05c24..67fb339 100644
--- a/camera/BufferSourceAdapter.cpp
+++ b/camera/BufferSourceAdapter.cpp
@@ -799,16 +799,14 @@ int BufferSourceAdapter::freeBufferList(CameraBuffer * buflist)
 
     status_t ret = NO_ERROR;
 
+    if ( mBuffers != buflist ) {
+        return BAD_VALUE;
+    }
+
     android::AutoMutex lock(mLock);
 
     if (mBufferSourceDirection == BUFFER_SOURCE_TAP_OUT) returnBuffersToWindow();
 
-    if ( NULL != buflist )
-    {
-        delete [] buflist;
-        mBuffers = NULL;
-    }
-
     if( mBuffers != NULL)
     {
         delete [] mBuffers;
@@ -878,6 +876,7 @@ void BufferSourceAdapter::handleFrameCallback(CameraFrame* frame)
     ret = mBufferSource->set_crop(mBufferSource, x, y, x + frame->mWidth, y + frame->mHeight);
     if (NO_ERROR != ret) {
         CAMHAL_LOGE("mBufferSource->set_crop returned error %d", ret);
+        goto fail;
     }
 
     if ( NULL != frame->mMetaData.get() ) {
@@ -888,6 +887,7 @@ void BufferSourceAdapter::handleFrameCallback(CameraFrame* frame)
             ret = extendedOps()->set_metadata(mBufferSource, extMeta);
             if (ret != 0) {
                 CAMHAL_LOGE("Surface::set_metadata returned error %d", ret);
+                goto fail;
             }
         }
     }
@@ -898,9 +898,18 @@ void BufferSourceAdapter::handleFrameCallback(CameraFrame* frame)
     ret = mBufferSource->enqueue_buffer(mBufferSource, handle);
     if (ret != 0) {
         CAMHAL_LOGE("Surface::queueBuffer returned error %d", ret);
+        goto fail;
     }
 
     mFramesWithCameraAdapterMap.removeItem((buffer_handle_t *) frame->mBuffer->opaque);
+
+    return;
+
+fail:
+    mFramesWithCameraAdapterMap.clear();
+    mBufferSource = NULL;
+    mReturnFrame->requestExit();
+    mQueueFrame->requestExit();
 }