Skip to content

Commit 7013cc7

Browse files
chaosmasteriqbal
authored andcommitted
Camera: fix possible nullptr on setCallbacks
Fix crashes like this: 05-03 20:55:09.029 6254 6254 F DEBUG : #00 pc 00000000 <unknown> 05-03 20:55:09.029 6254 6254 F DEBUG : DotOS#1 pc 000ec8ab /system/lib/libcameraservice.so (android::CameraHardwareInterface::notifyCallback(android::hardware::camera::device::V1_0::NotifyCallbackMsg, int, int)+18) (BuildId: 078b8118f1d0503988dc8f86045848d8) 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#2 pc 0002e6cd /system/lib/android.hardware.camera.device@1.0.so (android::hardware::camera::device::V1_0::BsCameraDeviceCallback::notifyCallback(android::hardware::camera::device::V1_0::NotifyCallbackMsg, int, int)+96) (BuildId: a964b5ab287096bfb4e9fb1357483757) 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#3 pc 00013783 /system/vendor/lib/camera.device@1.0-impl-htc_msm8960.so (android::hardware::camera::device::V1_0::implementation::CameraDevice::sNotifyCb(int, int, int, void*)+46) (BuildId: 183c013753a49cdceaf880f00b6083b7) 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#4 pc 00038b99 /system/vendor/lib/hw/camera.vendor.msm8960.so (android::QCameraStream_preview::processPreviewFrameWithDisplay(mm_camera_ch_data_buf_t*)+128) 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#5 pc 000086ff /system/lib/libmmcamera_interface2.so 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#6 pc 00008855 /system/lib/libmmcamera_interface2.so (mm_camera_msm_data_notify+248) 05-03 20:55:09.030 6254 6254 F DEBUG : DotOS#7 pc 0000736f /system/lib/libmmcamera_interface2.so 05-03 20:55:09.030 6254 6254 F DEBUG : #08 pc 000a6b67 /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+20) (BuildId: 1c34385a63ae9f807822c87c6b4126d2) 05-03 20:55:09.030 6254 6254 F DEBUG : #09 pc 00060101 /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: 1c34385a63ae9f807822c87c6b4126d2) In case of HTC One M7, the nullptr appears because of this call: https://github.com/AICP/frameworks_av/blob/q10.0/services/camera/libcameraservice/CameraFlashlight.cpp#L528 And while we're on it, lets fix some more possible nullptr's too. Change-Id: I2f67756d576d62560a2e65af55ab868bfc3e36ba Signed-off-by: Julian Veit <claymore1298@gmail.com>
1 parent b7d4048 commit 7013cc7

File tree

1 file changed

+12
-4
lines changed

1 file changed

+12
-4
lines changed

services/camera/libcameraservice/device1/CameraHardwareInterface.cpp

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,9 @@ hardware::Return<void> CameraHardwareInterface::handleCallbackTimestampBatch(
228228
msgs.push_back({hidl_msg.timestamp, mem->mBuffers[hidl_msg.bufferIndex]});
229229
}
230230
}
231-
mDataCbTimestampBatch((int32_t) msgType, msgs, mCbUser);
231+
if (mDataCbTimestampBatch != nullptr) {
232+
mDataCbTimestampBatch((int32_t) msgType, msgs, mCbUser);
233+
}
232234
return hardware::Void();
233235
}
234236

@@ -777,7 +779,9 @@ void CameraHardwareInterface::sNotifyCb(int32_t msg_type, int32_t ext1,
777779
ALOGV("%s", __FUNCTION__);
778780
CameraHardwareInterface *object =
779781
static_cast<CameraHardwareInterface *>(user);
780-
object->mNotifyCb(msg_type, ext1, ext2, object->mCbUser);
782+
if (object->mNotifyCb != nullptr) {
783+
object->mNotifyCb(msg_type, ext1, ext2, object->mCbUser);
784+
}
781785
}
782786

783787
void CameraHardwareInterface::sDataCb(int32_t msg_type,
@@ -794,7 +798,9 @@ void CameraHardwareInterface::sDataCb(int32_t msg_type,
794798
index, mem->mNumBufs);
795799
return;
796800
}
797-
object->mDataCb(msg_type, mem->mBuffers[index], metadata, object->mCbUser);
801+
if (object->mDataCb != nullptr){
802+
object->mDataCb(msg_type, mem->mBuffers[index], metadata, object->mCbUser);
803+
}
798804
}
799805

800806
void CameraHardwareInterface::sDataCbTimestamp(nsecs_t timestamp, int32_t msg_type,
@@ -813,7 +819,9 @@ void CameraHardwareInterface::sDataCbTimestamp(nsecs_t timestamp, int32_t msg_ty
813819
index, mem->mNumBufs);
814820
return;
815821
}
816-
object->mDataCbTimestamp(timestamp, msg_type, mem->mBuffers[index], object->mCbUser);
822+
if (object->mDataCbTimestamp != nullptr) {
823+
object->mDataCbTimestamp(timestamp, msg_type, mem->mBuffers[index], object->mCbUser);
824+
}
817825
}
818826

819827
camera_memory_t* CameraHardwareInterface::sGetMemory(

0 commit comments

Comments
 (0)