commit f15d9933a8a1493c1a114e78576da0af57330697
author Ranjith Kagathi Ananda <ranjith@codeaurora.org> Sat Aug 27 20:09:46 2016 +0000
committer android-build-merger <android-build-merger@google.com> Sat Aug 27 20:09:46 2016 +0000
tree 04941fb9210aa060b70651061b0b91d0f09e6e05
parent 1b607ed32302929e6b1dc3d21c407ca2d8e260bd
parent aef894151d5a1ef1f9270e1fdf45d345c367aa80

QCamera2/HAL3: Check if the key exists before accessing the value
am: aef894151d

Change-Id: I5540c7410a3f8beffe2afdf8f343491183eea7cb

QCamera2/HAL3/QCamera3HWI.cpp

diff --git a/QCamera2/HAL3/QCamera3HWI.cpp b/QCamera2/HAL3/QCamera3HWI.cpp
index 9000a19..8fe8301 100644
--- a/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/QCamera2/HAL3/QCamera3HWI.cpp
@@ -2731,8 +2731,15 @@
      * corresponding frame numbers and time stamps */
     pthread_mutex_lock(&mMutex);
     if (urgent_frame_number_valid) {
-        first_urgent_frame_number =
-                mPendingBatchMap.valueFor(last_urgent_frame_number);
+        ssize_t idx = mPendingBatchMap.indexOfKey(last_urgent_frame_number);
+        if(idx < 0) {
+            LOGE("Invalid urgent frame number received: %d. Irrecoverable error",
+                last_urgent_frame_number);
+            mState = ERROR;
+            pthread_mutex_unlock(&mMutex);
+            return;
+        }
+        first_urgent_frame_number = mPendingBatchMap.valueAt(idx);
         urgentFrameNumDiff = last_urgent_frame_number + 1 -
                 first_urgent_frame_number;
 
@@ -2742,7 +2749,15 @@
     }
 
     if (frame_number_valid) {
-        first_frame_number = mPendingBatchMap.valueFor(last_frame_number);
+        ssize_t idx = mPendingBatchMap.indexOfKey(last_frame_number);
+        if(idx < 0) {
+            LOGE("Invalid frame number received: %d. Irrecoverable error",
+                last_frame_number);
+            mState = ERROR;
+            pthread_mutex_unlock(&mMutex);
+            return;
+        }
+        first_frame_number = mPendingBatchMap.valueAt(idx);
         frameNumDiff = last_frame_number + 1 -
                 first_frame_number;
         mPendingBatchMap.removeItem(last_frame_number);