From: Jiyong Min <jiyong.min@samsung.com>
Date: Tue, 25 Oct 2016 12:05:18 +0000 (+0900)
Subject: Fix crash happen when __mm_util_processing return error.
X-Git-Tag: submit/tizen_3.0/20161108.053851^2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fheads%2Faccepted%2Ftizen_common;p=platform%2Fcore%2Fmultimedia%2Flibmm-utility.git

Fix crash happen when __mm_util_processing return error.

  [problem] The tbm buffer of media_packet should be free by media_packet_destroy.
           It may not be free when return error.

Change-Id: I24b90df29c48c7c3c5d15f8f1f87ac743320be8e
Signed-off-by: Jiyong Min <jiyong.min@samsung.com>
---

diff --git a/imgp/mm_util_imgp.c b/imgp/mm_util_imgp.c
index b16faa9..e41308b 100755
--- a/imgp/mm_util_imgp.c
+++ b/imgp/mm_util_imgp.c
@@ -990,7 +990,6 @@ static int __mm_util_processing(mm_util_s *handle)
 		handle->src = NULL;
 		if (media_packet_get_buffer_data_ptr(handle->src_packet, &handle->src) != MM_UTIL_ERROR_NONE) {
 			mm_util_error("[src] media_packet_get_extra");
-			IMGP_FREE(handle->src);
 			return MM_UTIL_ERROR_INVALID_PARAMETER;
 		}
 		mm_util_debug("src buffer pointer: %p", handle->src);
@@ -999,8 +998,6 @@ static int __mm_util_processing(mm_util_s *handle)
 	if (handle->dst_buf_size) {
 		handle->dst = NULL;
 		if (media_packet_get_buffer_data_ptr(handle->dst_packet, &handle->dst) != MM_UTIL_ERROR_NONE) {
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			mm_util_error("[dst] media_packet_get_extra");
 			return MM_UTIL_ERROR_INVALID_PARAMETER;
 		}
@@ -1014,8 +1011,6 @@ static int __mm_util_processing(mm_util_s *handle)
 	src_format = handle->src_format;
 	if (dst_buf[src_index] == NULL) {
 		mm_util_error("[multi func] memory allocation error");
-		IMGP_FREE(handle->src);
-		IMGP_FREE(handle->dst);
 		return MM_UTIL_ERROR_INVALID_OPERATION;
 	}
 	memcpy(dst_buf[src_index], handle->src, handle->src_buf_size);
@@ -1025,16 +1020,12 @@ static int __mm_util_processing(mm_util_s *handle)
 		dst_buf[dst_index] = g_malloc(dst_buf_size);
 		if (dst_buf[dst_index] == NULL) {
 			mm_util_error("[multi func] memory allocation error");
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			return MM_UTIL_ERROR_INVALID_OPERATION;
 		}
 		ret = mm_util_crop_image(dst_buf[src_index], src_width, src_height, src_format,
 		handle->start_x, handle->start_y, &handle->dst_width, &handle->dst_height, dst_buf[dst_index]);
 		if (ret != MM_UTIL_ERROR_NONE) {
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			mm_util_error("mm_util_crop_image failed");
 			return ret;
@@ -1048,15 +1039,11 @@ static int __mm_util_processing(mm_util_s *handle)
 		dst_buf[dst_index] = g_malloc(dst_buf_size);
 		if (dst_buf[dst_index] == NULL) {
 			mm_util_error("[multi func] memory allocation error");
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			return MM_UTIL_ERROR_INVALID_OPERATION;
 		}
 		ret = mm_util_resize_image(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], &handle->dst_width, &handle->dst_height);
 		if (ret != MM_UTIL_ERROR_NONE) {
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			mm_util_error("mm_util_resize_image failed");
 			return ret;
@@ -1072,15 +1059,11 @@ static int __mm_util_processing(mm_util_s *handle)
 		dst_buf[dst_index] = g_malloc(dst_buf_size);
 		if (dst_buf[dst_index] == NULL) {
 			mm_util_error("[multi func] memory allocation error");
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			return MM_UTIL_ERROR_INVALID_OPERATION;
 		}
 		ret = mm_util_convert_colorspace(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], handle->dst_format);
 		if (ret != MM_UTIL_ERROR_NONE) {
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			mm_util_error("mm_util_convert_colorspace failed");
 			return ret;
@@ -1108,15 +1091,11 @@ static int __mm_util_processing(mm_util_s *handle)
 		dst_buf[dst_index] = g_malloc(dst_buf_size);
 		if (dst_buf[dst_index] == NULL) {
 			mm_util_error("[multi func] memory allocation error");
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			return MM_UTIL_ERROR_INVALID_OPERATION;
 		}
 		ret = mm_util_rotate_image(dst_buf[src_index], src_width, src_height, src_format, dst_buf[dst_index], &handle->dst_width, &handle->dst_height, handle->dst_rotation);
 		if (ret != MM_UTIL_ERROR_NONE) {
-			IMGP_FREE(handle->src);
-			IMGP_FREE(handle->dst);
 			__mm_destroy_temp_buffer(dst_buf);
 			mm_util_error("mm_util_rotate_image failed");
 			return ret;
@@ -1294,6 +1273,8 @@ static int __mm_util_transform_exec(mm_util_s *handle, media_packet_h src_packet
 
 	if (ret != MM_UTIL_ERROR_NONE) {
 		mm_util_error("__mm_util_processing failed");
+		media_packet_destroy(handle->dst_packet);
+		handle->dst_packet = NULL;
 		return MM_UTIL_ERROR_INVALID_PARAMETER;
 	}
 
diff --git a/packaging/libmm-utility.spec b/packaging/libmm-utility.spec
index a997100..0d4904a 100755
--- a/packaging/libmm-utility.spec
+++ b/packaging/libmm-utility.spec
@@ -1,6 +1,6 @@
 Name:       libmm-utility
 Summary:    Multimedia Framework Utility Library
-Version:    0.25
+Version:    0.26
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0