commit b618fa8b323d5e6ec43e66fe6b23e4b63b08bbf5
author Emilian Peev <epeev@google.com> Fri Feb 21 13:55:56 2020 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Wed Apr 01 04:48:41 2020 +0000
tree f02ad7f60049b6898f49e2ee155490ae01c89bfd
parent b854edb6b93247d8dce1fe2c18705ada32d6cba2

QCamera2: Avoid accessing invalid data during flush

In some instances we could have either only pending
request lists or pending buffer maps. Make sure to
check both cases before trying to access any data
entries.

Bug: 149995442
Bug: 150004253
Test: Camera CTS

Change-Id: I47552708b82d43dd339162349e7e556340e540b8
Merged-In: I47552708b82d43dd339162349e7e556340e540b8
(cherry picked from commit a0654916efb18bd65eb43fe9089c9453dce01e55)
(cherry picked from commit f675b133d69aca5db65fbbb12dad68b7b611926a)
(cherry picked from commit 83d6468d5501942a3f46dee4be23f233f4ab23e7)

msm8998/QCamera2/HAL3/QCamera3HWI.cpp

diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
index 8a4b25c..4e58fcc 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
@@ -15141,7 +15141,8 @@
     while (pendingRequest != mPendingRequestsList.end() ||
            pendingBuffer != mPendingBuffersMap.mPendingBuffersInRequest.end()) {
         if (pendingRequest == mPendingRequestsList.end() ||
-            pendingBuffer->frame_number < pendingRequest->frame_number) {
+                ((pendingBuffer != mPendingBuffersMap.mPendingBuffersInRequest.end()) &&
+                 (pendingBuffer->frame_number < pendingRequest->frame_number))) {
             // If metadata for this frame was sent, notify about a buffer error and returns buffers
             // with error.
             for (auto &info : pendingBuffer->mPendingBufferList) {
@@ -15165,7 +15166,8 @@
 
             pendingBuffer = mPendingBuffersMap.mPendingBuffersInRequest.erase(pendingBuffer);
         } else if (pendingBuffer == mPendingBuffersMap.mPendingBuffersInRequest.end() ||
-                   pendingBuffer->frame_number > pendingRequest->frame_number) {
+                   ((pendingRequest != mPendingRequestsList.end()) &&
+                   (pendingBuffer->frame_number > pendingRequest->frame_number))) {
             // If the buffers for this frame were sent already, notify about a result error.
             camera3_notify_msg_t notify_msg;
             memset(&notify_msg, 0, sizeof(camera3_notify_msg_t));