libcamera: fix a use-after-free due an attempt to stop the camera twice

Camera is currently stopped and started in the spa_libcamera_set_format()
function, but this leads to a segfault due attempting to access a buffers
field of an already freed libcamera::FrameBufferAllocator instance.

The FrameBufferAllocator instance is freed in LibCamera::stop(), that is
called by spa_libcamera_stream_off() as handler of the node commands
SPA_NODE_COMMAND_Pause and SPA_NODE_COMMAND_Suspend.

Since the camera was already stopped, there's no need to attempt to stop
it again. In fact, the camera shouldn't be stopped/started at all in the
spa_libcamera_set_format() function but instead only as an action of the
SPA_NODE_COMMAND_{Pause,Suspend} and SPA_NODE_COMMAND_Start commands.

And same for the stop that's done in the LibCamera::close() function, it
shouldn't be needed because the camera is already stopped before closing.

Fixes #1513
This commit is contained in:
Javier Martinez Canillas 2021-09-21 14:44:17 +02:00
parent a7a6f19815
commit 21c412dc49
No known key found for this signature in database
GPG key ID: C751E590D63F3D69
2 changed files with 2 additions and 7 deletions

View file

@ -540,7 +540,6 @@ extern "C" {
}
void LibCamera::close() {
this->stop();
this->cam_->release();
}