Fix a media server crash due to a race condition in the Camera MIO

The problem was that the pmemInfo can be changed from both the OpenCore omx proxy thread and the callback thread, and thus needs to be protected.

bug - 2374541

1 files changed, 17 insertions, 19 deletions

diff --git a/android/author/android_camera_input.cpp b/android/author/android_camera_input.cpp
index c4424523a..379b708de 100644
--- a/android/author/android_camera_input.cpp
+++ b/android/author/android_camera_input.cpp
@@ -92,6 +92,11 @@ void AndroidCameraInput::ReleaseQueuedFrames()
 #endif
         mCamera->releaseRecordingFrame(data.iFrameBuffer);
     }
+    if(pPmemInfo)
+    {
+        delete pPmemInfo;
+        pPmemInfo = NULL;
+    }
     iFrameQueueMutex.Unlock();
 }
 
@@ -117,11 +122,6 @@ AndroidCameraInput::~AndroidCameraInput()
     }
     iFrameQueueMutex.Close();
     mListener.clear();
-    if(pPmemInfo)
-    {
-        delete pPmemInfo;
-        pPmemInfo = NULL;
-    }
 }
 
 PVMFStatus AndroidCameraInput::connect(PvmiMIOSession& aSession,
@@ -733,6 +733,9 @@ void AndroidCameraInput::Run()
 
     // dequeue frame buffers and write to peer
     if (NULL != iPeer) {
+        if (iState != STATE_STARTED) {
+            ReleaseQueuedFrames();
+        }
         iFrameQueueMutex.Lock();
         while (!iFrameQueue.empty()) {
             AndroidCameraInputMediaData data = iFrameQueue[0];
@@ -1028,14 +1031,9 @@ PVMFStatus AndroidCameraInput::DoStop(const AndroidCameraInputCmd& aCmd)
     iDataEventCounter = 0;
     iWriteState = EWriteOK;
     if (mCamera != NULL) {
-    mCamera->setListener(NULL);
-    mCamera->stopRecording();
-    ReleaseQueuedFrames();
-    if(pPmemInfo)
-    {
-        delete pPmemInfo;
-        pPmemInfo = NULL;
-    }
+        mCamera->setListener(NULL);
+        mCamera->stopRecording();
+        ReleaseQueuedFrames();
     }
     iState = STATE_STOPPED;
     return PVMFSuccess;
@@ -1217,7 +1215,11 @@ PVMFStatus AndroidCameraInput::postWriteAsync(nsecs_t timestamp, const sp<IMemor
     data.iXferHeader.flags = 0;
     data.iXferHeader.duration = 0;
     data.iXferHeader.stream_id = 0;
+    data.iFrameSize = size;
+    data.iFrameBuffer = frame;
 
+    // lock muteddx and queue frame buffer
+    iFrameQueueMutex.Lock();
     {//compose private data
         //could size be zero?
         if(NULL == pPmemInfo)
@@ -1228,6 +1230,7 @@ PVMFStatus AndroidCameraInput::postWriteAsync(nsecs_t timestamp, const sp<IMemor
             if(NULL == pPmemInfo)
             {
                 LOGE("Failed to allocate the camera pmem info buffer array. iCalculateNoOfCameraPreviewBuffer %d",iCalculateNoOfCameraPreviewBuffer);
+                iFrameQueueMutex.Unlock();
                 return PVMFFailure;
             }
         }
@@ -1239,16 +1242,11 @@ PVMFStatus AndroidCameraInput::postWriteAsync(nsecs_t timestamp, const sp<IMemor
         LOGV("struct size %d, pmem_info - %x, &pmem_info[iIndex] - %x, iIndex =%d, pmem_info.pmem_fd = %d, pmem_info.offset = %d", sizeof(CAMERA_PMEM_INFO), pPmemInfo, &pPmemInfo[iIndex], iIndex, pPmemInfo[iIndex].pmem_fd, pPmemInfo[iIndex].offset );
     }
 
-    data.iFrameBuffer = frame;
-    data.iFrameSize = size;
-
-    // lock mutex and queue frame buffer
-    iFrameQueueMutex.Lock();
     iFrameQueue.push_back(data);
     iFrameQueueMutex.Unlock();
     RunIfNotReady();
 
-    return PVMFSuccess; 
+    return PVMFSuccess;
 }
 
 // camera callback interface