commit cf49a51ff59c3cd228d178d23252ac0d39d5a893
author Chong Zhang <chz@google.com> Fri Feb 14 15:26:00 2014 -0800
committer Chong Zhang <chz@google.com> Tue Mar 11 22:10:05 2014 +0000
tree 8e8ae43c84f8752b567176fe8a9260cbdfa73f10
parent c69bc40a347c411751cb082b3eb4a82d976a68ec

fix codec buffer leak in error handling when timestamp goes backward

don't touch codec buffer if we decided to drop a frame with bad pts

Bug: 11971963
Change-Id: I9b4c56210f64258f1be257b14184381a1133e0d6
(cherry picked from commit b63d2433350d56bda9f3477549086c90bb6d535e)

media/libstagefright/omx/GraphicBufferSource.cpp

diff --git a/media/libstagefright/omx/GraphicBufferSource.cpp b/media/libstagefright/omx/GraphicBufferSource.cpp
index 20fa7ce..44f0be7 100644
--- a/media/libstagefright/omx/GraphicBufferSource.cpp
+++ b/media/libstagefright/omx/GraphicBufferSource.cpp
@@ -562,7 +562,7 @@
             if (originalTimeUs < mPrevOriginalTimeUs) {
                 // Drop the frame if it's going backward in time. Bad timestamp
                 // could disrupt encoder's rate control completely.
-                ALOGV("Dropping frame that's going backward in time");
+                ALOGW("Dropping frame that's going backward in time");
                 return -1;
             }
             int64_t timestampGapUs = originalTimeUs - mPrevOriginalTimeUs;
@@ -581,6 +581,12 @@
 status_t GraphicBufferSource::submitBuffer_l(
         const BufferQueue::BufferItem &item, int cbi) {
     ALOGV("submitBuffer_l cbi=%d", cbi);
+
+    int64_t timeUs = getTimestamp(item);
+    if (timeUs < 0ll) {
+        return UNKNOWN_ERROR;
+    }
+
     CodecBuffer& codecBuffer(mCodecBuffers.editItemAt(cbi));
     codecBuffer.mGraphicBuffer = mBufferSlot[item.mBuf];
     codecBuffer.mBuf = item.mBuf;
@@ -594,12 +600,6 @@
     memcpy(data, &type, 4);
     memcpy(data + 4, &handle, sizeof(buffer_handle_t));
 
-    int64_t timeUs = getTimestamp(item);
-    if (timeUs < 0ll) {
-        ALOGE("Dropping frame with bad timestamp");
-        return UNKNOWN_ERROR;
-    }
-
     status_t err = mNodeInstance->emptyDirectBuffer(header, 0,
             4 + sizeof(buffer_handle_t), OMX_BUFFERFLAG_ENDOFFRAME,
             timeUs);