tree 72f0e7680065017a1553f2cc00e60766cefcccd6
parent ac31fb897846c6e8c72ade7fa5e4ab3c00bf77c9
author Shuzhen Wang <shuzhenwang@google.com> 1500070459 -0700
committer Shuzhen Wang <shuzhenwang@google.com> 1500074878 -0700

Camera: Fix "use after free" for mOutstandingBuffers

Fix below use after free issues:

==4947==ERROR: AddressSanitizer: heap-use-after-free on address
0xec61f434 at pc 0xf1954c18 bp 0xed3ff6f0 sp 0xed3ff6e8
READ of size 4 at 0xec61f434 thread T12 (C3Dev-1-ReqQueu)
  #0 0xf1954c17 in _ZN7android7camera313Camera3Stream23removeOutstandingBufferERK21camera3_stream_buffer
  frameworks/av/services/camera/libcameraservice/device3/Camera3Stream.cpp:508
  #1 0xf1954c17 in _ZN7android7camera313Camera3Stream12returnBufferERK21camera3_stream_bufferx
  frameworks/av/services/camera/libcameraservice/device3/Camera3Stream.cpp:543
  #2 0xf193c663 in _ZN7android13Camera3Device13RequestThread21cleanUpFailedRequestsEb
  frameworks/av/services/camera/libcameraservice/device3/Camera3Device.cpp:4131
  #3 0xf193db5b in _ZN7android13Camera3Device13RequestThread10threadLoopEv
  frameworks/av/services/camera/libcameraservice/device3/Camera3Device.cpp:3854
  #4 0xf1562f35 in _ZN7android6Thread11_threadLoopEPv system/core/libutils/Threads.cpp:747
  #5 0xf0ee6947 in _ZL15__pthread_startPv bionic/libc/bionic/pthread_create.cpp:214
  #6 0xf0eba381 in __start_thread bionic/libc/bionic/clone.cpp:47

0xec61f434 is located 68 bytes inside of 136-byte region [0xec61f3f0,0xec61f478)
freed by thread T0 here:
  #7 0xf1a64963 in _ZdlPvSt11align_val_tRKSt9nothrow_t [asan_rtl]
  #8 0xf155df09 in _ZNK7android7RefBase9decStrongEPKv system/core/libutils/RefBase.cpp:435
  #9 0xf19693ab in _ZN7android7camera319Camera3OutputStream22BufferReleasedListener16onBufferReleasedEv
    frameworks/av/services/camera/libcameraservice/device3/Camera3OutputStream.cpp:720
  #3 0x1ff56dfb  (<unknown module>)

Bug: 62218367
Change-Id: Ib03415f73a1e3c283520af752904b1bcc40bff28