commit edab4e66f94bbc621155a4686ab3140b6db1ee5c
author Ren-Pei Zeng <kamesan@chromium.org> Thu Apr 25 05:09:53 2019
committer chrome-bot <chrome-bot@chromium.org> Thu Apr 25 18:27:31 2019
tree 928715fa9dde4ab4b2ace381163e45da981c21fc
parent e6a2d5a2f7c95bf0c80ca104730964155402d04a

camera: camera3_test: Replace freed buffer test by invalid handle test

Since accessing the memory pointed by a Free()'d buffer_handle_t is not
legal, remove the FreeBufferHandle test. Instead, add a
InvalidBufferHandle test that uses a handle pointing to a legal memory
of invalid content.

BUG=b:131195719
TEST=Pass Camera3FrameTest/Camera3InvalidBufferTest.*

Change-Id: Ie7b5e5547946bacbe26c71abc9a99843de31faa8
Reviewed-on: https://chromium-review.googlesource.com/1583566
Commit-Ready: Ren-Pei Zeng <kamesan@chromium.org>
Tested-by: Ren-Pei Zeng <kamesan@chromium.org>
Reviewed-by: Hung-yu Wu <hywu@chromium.org>

camera/camera3_test/camera3_frame_test.cc

diff --git a/camera/camera3_test/camera3_frame_test.cc b/camera/camera3_test/camera3_frame_test.cc
index 7ba3d3b..ebc7ad4 100644
--- a/camera/camera3_test/camera3_frame_test.cc
+++ b/camera/camera3_test/camera3_frame_test.cc
@@ -1284,13 +1284,11 @@
   RunInvalidBufferTest(&handle);
 }
 
-TEST_P(Camera3InvalidBufferTest, FreedBufferHandle) {
-  BufferHandleUniquePtr buffer = Camera3TestGralloc::GetInstance()->Allocate(
-      default_width_, default_height_, HAL_PIXEL_FORMAT_YCbCr_420_888,
-      GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_HW_CAMERA_WRITE);
-  ASSERT_NE(nullptr, buffer);
-  buffer_handle_t handle = *buffer.get();
-  buffer.reset();
+TEST_P(Camera3InvalidBufferTest, InvalidBufferHandle) {
+  // Make an invalid buffer handle with a wrong magic number.
+  auto cbh = std::make_unique<camera_buffer_handle_t>();
+  cbh->magic = ~cbh->magic;
+  buffer_handle_t handle = reinterpret_cast<buffer_handle_t>(cbh.get());
   RunInvalidBufferTest(&handle);
 }
 

camera/common/camera_buffer_manager_impl.cc

diff --git a/camera/common/camera_buffer_manager_impl.cc b/camera/common/camera_buffer_manager_impl.cc
index 62e14f0..98eef79 100644
--- a/camera/common/camera_buffer_manager_impl.cc
+++ b/camera/common/camera_buffer_manager_impl.cc
@@ -296,6 +296,9 @@
 
 int CameraBufferManagerImpl::Free(buffer_handle_t buffer) {
   auto handle = camera_buffer_handle_t::FromBufferHandle(buffer);
+  if (!handle) {
+    return -EINVAL;
+  }
 
   if (handle->type == GRALLOC) {
     Deregister(buffer);