From 860eff192e00df5977be5ff8a6fbf3efa6f1f8d5 Mon Sep 17 00:00:00 2001
From: Chong Zhang <chz@google.com>
Date: Mon, 16 Sep 2019 16:15:00 -0700
Subject: [PATCH] Make a copy of output format in onOutputFormatChanged

Make a copy of output format in NDK and camera's heic encoder.
(MediaCodec.java JNI is already making a copy, so copy out of
MediaCodec.cpp to avoid unnecessary dup)

bug:141140020
Change-Id: I8afb1e48b73f0fb2fa584bdee2b93985b48a5e91
---
 media/ndk/NdkMediaCodec.cpp                              | 8 +++++++-
 .../camera/libcameraservice/api2/HeicCompositeStream.cpp | 9 +++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/media/ndk/NdkMediaCodec.cpp b/media/ndk/NdkMediaCodec.cpp
index c23f19b9d2..e041533586 100644
--- a/media/ndk/NdkMediaCodec.cpp
+++ b/media/ndk/NdkMediaCodec.cpp
@@ -221,7 +221,13 @@ void CodecHandler::onMessageReceived(const sp<AMessage> &msg) {
                          break;
                      }
 
-                     AMediaFormat *aMediaFormat = AMediaFormat_fromMsg(&format);
+                     // Here format is MediaCodec's internal copy of output format.
+                     // Make a copy since the client might modify it.
+                     sp<AMessage> copy;
+                     if (format != nullptr) {
+                         copy = format->dup();
+                     }
+                     AMediaFormat *aMediaFormat = AMediaFormat_fromMsg(&copy);
 
                      Mutex::Autolock _l(mCodec->mAsyncCallbackLock);
                      if (mCodec->mAsyncCallbackUserData != NULL
diff --git a/services/camera/libcameraservice/api2/HeicCompositeStream.cpp b/services/camera/libcameraservice/api2/HeicCompositeStream.cpp
index 5a87134743..052112a821 100644
--- a/services/camera/libcameraservice/api2/HeicCompositeStream.cpp
+++ b/services/camera/libcameraservice/api2/HeicCompositeStream.cpp
@@ -1671,8 +1671,13 @@ void HeicCompositeStream::CodecCallbackHandler::onMessageReceived(const sp<AMess
                          ALOGE("CB_OUTPUT_FORMAT_CHANGED: format is expected.");
                          break;
                      }
-
-                     parent->onHeicFormatChanged(format);
+                     // Here format is MediaCodec's internal copy of output format.
+                     // Make a copy since onHeicFormatChanged() might modify it.
+                     sp<AMessage> formatCopy;
+                     if (format != nullptr) {
+                         formatCopy = format->dup();
+                     }
+                     parent->onHeicFormatChanged(formatCopy);
                      break;
                  }