Fix TSAM-7245

When app sets EVAS surface type and uses media packet callback,
crash can be occurred if destroy media packet in media packet callback
because tbm bo in packet is unreferenced when media packet is destroyed,
and after that, bo is used to creating new media packet for EVAS rendering.
So, some code is updated to avoid that crash.

[Version] 0.2.74
[Profile] Common
[Issue Type] Bug fix
[Dependency module] N/A
[Dependency commit] N/A
[Test] [M(T) - Boot=(OK), sdb=(OK), Home=(OK), Touch=(OK), Version=tizen-mobile_20160913.1]

Change-Id: Idbe6f7a2ac64bb6043a89ac984d7c0a3fe4ca9a8
Signed-off-by: Jeongmo Yang <jm80.yang@samsung.com>

2 files changed, 27 insertions, 27 deletions

diff --git a/packaging/capi-media-camera.spec b/packaging/capi-media-camera.spec
index 5a8a3a9..62af3e8 100644
--- a/packaging/capi-media-camera.spec
+++ b/packaging/capi-media-camera.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-camera
 Summary:    A Camera API
-Version:    0.2.73
+Version:    0.2.74
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0
diff --git a/src/camera.c b/src/camera.c
index 78bf839..567a3be 100644
--- a/src/camera.c
+++ b/src/camera.c
@@ -1088,6 +1088,7 @@ static void _camera_client_user_callback(camera_cb_info_s *cb_info, char *recv_m
 			camera_stream_data_s *stream = NULL;
 			camera_media_packet_data *mp_data = NULL;
 			media_packet_h pkt = NULL;
+			media_packet_h pkt_evas = NULL;
 
 			muse_camera_msg_get(tbm_key, recv_msg);
 			muse_camera_msg_get(num_buffer_key, recv_msg);
@@ -1152,52 +1153,51 @@ static void _camera_client_user_callback(camera_cb_info_s *cb_info, char *recv_m
 					cb_info->user_data[MUSE_CAMERA_EVENT_TYPE_PREVIEW]);
 			}
 
-			/* call media packet callback */
-			if (cb_info->user_cb[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW]) {
+			if (CHECK_PREVIEW_CB(cb_info, PREVIEW_CB_TYPE_EVAS)) {
+#ifdef TIZEN_FEATURE_EVAS_RENDERER
 				ret = _camera_media_packet_data_create(tbm_key, num_buffer_key, bo, buffer_bo, data_bo, &mp_data);
 
 				if (ret == CAMERA_ERROR_NONE) {
-					ret = _camera_media_packet_create(cb_info, stream, mp_data, &pkt);
-
-					if (ret == CAMERA_ERROR_NONE) {
-						((camera_media_packet_preview_cb)cb_info->user_cb[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW])(pkt,
-							cb_info->user_data[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW]);
-					} else {
+					ret = _camera_media_packet_create(cb_info, stream, mp_data, &pkt_evas);
+					if (ret != CAMERA_ERROR_NONE) {
+						LOGE("create pkt for evas failed");
 						_camera_media_packet_data_release(mp_data, cb_info);
 						mp_data = NULL;
 					}
 				}
+#else /* TIZEN_FEATURE_EVAS_RENDERER */
+				LOGW("evas renderer is not supported");
+#endif /* TIZEN_FEATURE_EVAS_RENDERER */
 			}
 
-			/* call evas renderer */
-			if (CHECK_PREVIEW_CB(cb_info, PREVIEW_CB_TYPE_EVAS)) {
-#ifdef TIZEN_FEATURE_EVAS_RENDERER
+			/* call media packet callback */
+			if (cb_info->user_cb[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW]) {
 				ret = _camera_media_packet_data_create(tbm_key, num_buffer_key, bo, buffer_bo, data_bo, &mp_data);
 
 				if (ret == CAMERA_ERROR_NONE) {
 					ret = _camera_media_packet_create(cb_info, stream, mp_data, &pkt);
 
 					if (ret == CAMERA_ERROR_NONE) {
-						g_mutex_lock(&cb_info->evas_mutex);
-
-						if (cb_info->run_evas_render) {
-							mm_evas_renderer_write(pkt, cb_info->evas_info);
-						} else {
-							LOGW("evas renderer is stopped, skip this buffer...");
-							media_packet_destroy(pkt);
-						}
-
-						pkt = NULL;
-
-						g_mutex_unlock(&cb_info->evas_mutex);
+						((camera_media_packet_preview_cb)cb_info->user_cb[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW])(pkt,
+							cb_info->user_data[MUSE_CAMERA_EVENT_TYPE_MEDIA_PACKET_PREVIEW]);
 					} else {
 						_camera_media_packet_data_release(mp_data, cb_info);
 						mp_data = NULL;
 					}
 				}
-#else /* TIZEN_FEATURE_EVAS_RENDERER */
-				LOGW("evas renderer is not supported");
-#endif /* TIZEN_FEATURE_EVAS_RENDERER */
+			}
+
+			/* call evas renderer */
+			if (pkt_evas) {
+				g_mutex_lock(&cb_info->evas_mutex);
+				if (cb_info->run_evas_render) {
+					mm_evas_renderer_write(pkt_evas, cb_info->evas_info);
+				} else {
+					LOGW("evas renderer is stopped, skip this buffer...");
+					media_packet_destroy(pkt_evas);
+				}
+				pkt_evas = NULL;
+				g_mutex_unlock(&cb_info->evas_mutex);
 			}
 
 			/* send message for preview callback return */