Fix crash happen when __mm_util_processing return error.

  [problem] The tbm buffer of media_packet should be free by media_packet_destroy.
           It may not be free when return error.

Change-Id: I24b90df29c48c7c3c5d15f8f1f87ac743320be8e
Signed-off-by: Jiyong Min <jiyong.min@samsung.com>

diff --git a/imgp/mm_util_imgp.c b/imgp/mm_util_imgp.c
index b16faa9..e41308b 100755 (executable)
--- a/imgp/mm_util_imgp.c
+++ b/imgp/mm_util_imgp.c
@@ -990,7 +990,6 @@ static int __mm_util_processing(mm_util_s *handle)
                handle->src = NULL;
                if (media_packet_get_buffer_data_ptr(handle->src_packet, &handle->src) != MM_UTIL_ERROR_NONE) {
                        mm_util_error("[src] media_packet_get_extra");
-                       IMGP_FREE(handle->src);
                        return MM_UTIL_ERROR_INVALID_PARAMETER;
                }
                mm_util_debug("src buffer pointer: %p", handle->src);
@@ -999,8 +998,6 @@ static int __mm_util_processing(mm_util_s *handle)
        if (handle->dst_buf_size) {
                handle->dst = NULL;
                if (media_packet_get_buffer_data_ptr(handle->dst_packet, &handle->dst) != MM_UTIL_ERROR_NONE) {
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        mm_util_error("[dst] media_packet_get_extra");
                        return MM_UTIL_ERROR_INVALID_PARAMETER;
                }
@@ -1014,8 +1011,6 @@ static int __mm_util_processing(mm_util_s *handle)
        src_format = handle->src_format;
        if (dst_buf[src_index] == NULL) {
                mm_util_error("[multi func] memory allocation error");
-               IMGP_FREE(handle->src);
-               IMGP_FREE(handle->dst);
                return MM_UTIL_ERROR_INVALID_OPERATION;
        }
        memcpy(dst_buf[src_index], handle->src, handle->src_buf_size);
@@ -1025,16 +1020,12 @@ static int __mm_util_processing(mm_util_s *handle)
                dst_buf[dst_index] = g_malloc(dst_buf_size);
                if (dst_buf[dst_index] == NULL) {
                        mm_util_error("[multi func] memory allocation error");
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
                ret = mm_util_crop_image(dst_buf[src_index], src_width, src_height, src_format,
                handle->start_x, handle->start_y, &handle->dst_width, &handle->dst_height, dst_buf[dst_index]);
                if (ret != MM_UTIL_ERROR_NONE) {
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        mm_util_error("mm_util_crop_image failed");
                        return ret;
@@ -1048,15 +1039,11 @@ static int __mm_util_processing(mm_util_s *handle)
                dst_buf[dst_index] = g_malloc(dst_buf_size);
                if (dst_buf[dst_index] == NULL) {
                        mm_util_error("[multi func] memory allocation error");
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
                ret = mm_util_resize_image(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], &handle->dst_width, &handle->dst_height);
                if (ret != MM_UTIL_ERROR_NONE) {
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        mm_util_error("mm_util_resize_image failed");
                        return ret;
@@ -1072,15 +1059,11 @@ static int __mm_util_processing(mm_util_s *handle)
                dst_buf[dst_index] = g_malloc(dst_buf_size);
                if (dst_buf[dst_index] == NULL) {
                        mm_util_error("[multi func] memory allocation error");
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
                ret = mm_util_convert_colorspace(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], handle->dst_format);
                if (ret != MM_UTIL_ERROR_NONE) {
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        mm_util_error("mm_util_convert_colorspace failed");
                        return ret;
@@ -1108,15 +1091,11 @@ static int __mm_util_processing(mm_util_s *handle)
                dst_buf[dst_index] = g_malloc(dst_buf_size);
                if (dst_buf[dst_index] == NULL) {
                        mm_util_error("[multi func] memory allocation error");
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        return MM_UTIL_ERROR_INVALID_OPERATION;
                }
                ret = mm_util_rotate_image(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], &handle->dst_width, &handle->dst_height, handle->dst_rotation);
                if (ret != MM_UTIL_ERROR_NONE) {
-                       IMGP_FREE(handle->src);
-                       IMGP_FREE(handle->dst);
                        __mm_destroy_temp_buffer(dst_buf);
                        mm_util_error("mm_util_rotate_image failed");
                        return ret;
@@ -1294,6 +1273,8 @@ static int __mm_util_transform_exec(mm_util_s *handle, media_packet_h src_packet
 
        if (ret != MM_UTIL_ERROR_NONE) {
                mm_util_error("__mm_util_processing failed");
+               media_packet_destroy(handle->dst_packet);
+               handle->dst_packet = NULL;
                return MM_UTIL_ERROR_INVALID_PARAMETER;
        }
 

diff --git a/packaging/libmm-utility.spec b/packaging/libmm-utility.spec
index a997100..0d4904a 100755 (executable)
--- a/packaging/libmm-utility.spec
+++ b/packaging/libmm-utility.spec
@@ -1,6 +1,6 @@
 Name:       libmm-utility
 Summary:    Multimedia Framework Utility Library
-Version:    0.25
+Version:    0.26
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0