From: Jeongmo Yang <jm80.yang@samsung.com>
Date: Thu, 2 Feb 2023 05:39:14 +0000 (+0900)
Subject: Fix crash when zero copy mode with I420 format
X-Git-Tag: accepted/tizen/unified/20230207.165815~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F68%2F287668%2F1;p=platform%2Fcore%2Fapi%2Fcamera.git

Fix crash when zero copy mode with I420 format

- The pointer "buffer_bo_handle[1].ptr" is invalid at that case.

[Version] 0.4.98
[Issue Type] Bug fix

Change-Id: Ic39f533eb226d31346c8abcd7798cddb692e9df5
Signed-off-by: Jeongmo Yang <jm80.yang@samsung.com>
---

diff --git a/packaging/capi-media-camera.spec b/packaging/capi-media-camera.spec
index 624636c..ba29c34 100644
--- a/packaging/capi-media-camera.spec
+++ b/packaging/capi-media-camera.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-camera
 Summary:    A Camera API
-Version:    0.4.97
+Version:    0.4.98
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0
diff --git a/src/camera_internal.c b/src/camera_internal.c
index fe5468b..577ab8e 100644
--- a/src/camera_internal.c
+++ b/src/camera_internal.c
@@ -204,7 +204,7 @@ void camera_create_preview_frame(MMCamcorderVideoStreamDataType *stream, int num
 				frame->data.triple_plane.v = buffer_bo_handle[2].ptr;
 			} else {
 				frame->data.triple_plane.u = buffer_bo_handle[0].ptr + stream->data.yuv420p.length_y;
-				frame->data.triple_plane.v = buffer_bo_handle[1].ptr + stream->data.yuv420p.length_u;
+				frame->data.triple_plane.v = frame->data.triple_plane.u + stream->data.yuv420p.length_u;
 			}
 			frame->data.triple_plane.y_size = stream->data.yuv420p.length_y;
 			frame->data.triple_plane.u_size = stream->data.yuv420p.length_u;