commit 0563856386d6407806ed8f577ed768dc3be00ec8
author Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Mar 16 23:42:52 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Mar 16 23:42:52 2020 +0000
tree d1f1003e4bd4af3d2de3545463ebe3b79b8ab03c
parent 39f5126733727855973996dbda58de998ec06bb0
parent 33cc55010dfa0248e73a851fdc287f6acc76a45e

Merge "QCamera2: Avoid accessing invalid data during flush" into oc-dr1-dev am: 33cc55010d

Change-Id: Idb6a86867747c29cce37cf7c999b0537805a468a

msm8998/QCamera2/HAL3/QCamera3HWI.cpp

diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
index d190eba..a9c822c 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
@@ -14547,7 +14547,8 @@
     while (pendingRequest != mPendingRequestsList.end() ||
            pendingBuffer != mPendingBuffersMap.mPendingBuffersInRequest.end()) {
         if (pendingRequest == mPendingRequestsList.end() ||
-            pendingBuffer->frame_number < pendingRequest->frame_number) {
+                ((pendingBuffer != mPendingBuffersMap.mPendingBuffersInRequest.end()) &&
+                 (pendingBuffer->frame_number < pendingRequest->frame_number))) {
             // If metadata for this frame was sent, notify about a buffer error and returns buffers
             // with error.
             for (auto &info : pendingBuffer->mPendingBufferList) {
@@ -14571,7 +14572,8 @@
 
             pendingBuffer = mPendingBuffersMap.mPendingBuffersInRequest.erase(pendingBuffer);
         } else if (pendingBuffer == mPendingBuffersMap.mPendingBuffersInRequest.end() ||
-                   pendingBuffer->frame_number > pendingRequest->frame_number) {
+                   ((pendingRequest != mPendingRequestsList.end()) &&
+                   (pendingBuffer->frame_number > pendingRequest->frame_number))) {
             // If the buffers for this frame were sent already, notify about a result error.
             camera3_notify_msg_t notify_msg;
             memset(&notify_msg, 0, sizeof(camera3_notify_msg_t));