Code: void CameraSource::dataCallbackTimestamp(int64_t timestampUs,
 int32_t msgType __unused, const sp<IMemory> &data) {
    ALOGV("dataCallbackTimestamp: timestamp %lld us", (long long)timestampUs);
 Mutex::Autolock autoLock(mLock);
 if (!mStarted || (mNumFramesReceived == 0 && timestampUs < mStartTimeUs)) {
        ALOGV("Drop frame at %lld/%lld us", (long long)timestampUs, (long long)mStartTimeUs);
        releaseOneRecordingFrame(data);
 return;
 }

 if (skipCurrentFrame(timestampUs)) {
        releaseOneRecordingFrame(data);
 return;
 }

 if (mNumFramesReceived > 0) {
 if (timestampUs <= mLastFrameTimestampUs) {
            ALOGW("Dropping frame with backward timestamp %lld (last %lld)",
 (long long)timestampUs, (long long)mLastFrameTimestampUs);
            releaseOneRecordingFrame(data);
 return;
 }
 if (timestampUs - mLastFrameTimestampUs > mGlitchDurationThresholdUs) {
 ++mNumGlitches;
 }
 }

    mLastFrameTimestampUs = timestampUs;
 if (mNumFramesReceived == 0) {
        mFirstFrameTimeUs = timestampUs;
 if (mStartTimeUs > 0) {
 if (timestampUs < mStartTimeUs) {
                releaseOneRecordingFrame(data);
 return;
 }
            mStartTimeUs = timestampUs - mStartTimeUs;
 }
 }

     ++mNumFramesReceived;
 
     CHECK(data != NULL && data->size() > 0);
     mFramesReceived.push_back(data);
     int64_t timeUs = mStartTimeUs + (timestampUs - mFirstFrameTimeUs);
     mFrameTimes.push_back(timeUs);
    ALOGV("initial delay: %" PRId64 ", current time stamp: %" PRId64,
        mStartTimeUs, timeUs);
    mFrameAvailableCondition.signal();
}

Vulnerability Type: Bypass +Info 
CWE ID: CWE-200
Summary: The camera APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allow attackers to bypass intended access restrictions and obtain sensitive information about ANW buffer addresses via a crafted application, aka internal bug 28466701.
Commit Message: DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak

Subtract address of a random static object from pointers being routed
through app process.

Bug: 28466701
Change-Id: Idcbfe81e9507433769672f3dc6d67db5eeed4e04
