From 1c48dc5f2399bb6ebad2ff0cda39be37688af27e Mon Sep 17 00:00:00 2001
From: Arian <arian.kulmer@web.de>
Date: Sat, 11 Apr 2026 21:30:48 +0700
Subject: [PATCH] rosemary: Patch a few camera blobs to allocate GraphicBuffer
 with new size

Commit [1] ("Introduce a dependency monitor for fences") has added new
members to the GraphicBuffer struct, increasing the size from 0x100 to
0xd30. camera.xiaomi.so creates GraphicBuffer in its constructors using
"new GraphicBuffer(..)" which encodes the size to allocate at compile
time. Then, on destruction of the object, the implicit destructor will
try to destruct the new members, but, since this memory was not
allocated for the object, this leads to memory access of unallocated
storage.

F DEBUG   : backtrace:
F DEBUG   :       #00 pc 000000000003ba00  /vendor/lib64/libui.so (__aarch64_ldadd8_acq_rel+16) (BuildId: b577faa139eb3404c7d3a674b147634c)
F DEBUG   :       #01 pc 0000000000051364  /vendor/lib64/libui.so (android::GraphicBuffer::~GraphicBuffer()+248) (BuildId: b577faa139eb3404c7d3a674b147634c)
F DEBUG   :       #02 pc 0000000000051698  /vendor/lib64/libui.so (android::GraphicBuffer::~GraphicBuffer()+20) (BuildId: b577faa139eb3404c7d3a674b147634c)
F DEBUG   :       #03 pc 0000000000011064  /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+164) (BuildId: 99d1ab745e7b73420d8d2b397483ef54)
F DEBUG   :       #04 pc 00000000000cd538  /vendor/lib64/hw/camera.xiaomi.so (mihal::GraBuffer::~GraBuffer()+236) (BuildId: a4c59705588bd26d407f0ab181902baf)

[1]: https://github.com/LineageOS/android_frameworks_native/commit/df868baf2abefbb45341530d20a948ffd6b2c304

Change-Id: I239c31b6ea5a7813abc3e9cfbefb6d2bdcc1a9e0
Signed-off-by: therealmharc <therealmharc@gmail.com>
Signed-off-by: Ido <dev.xyzuniverse@gmail.com>
---
 Android.bp                                    |   1 +
 proprietary/vendor/lib64/libcam.hal3a.v3.so   | Bin 3033680 -> 3033680 bytes
 .../lib64/libmtkcam_3rdparty.customer.so      | Bin 535352 -> 535352 bytes
 3 files changed, 1 insertion(+)

diff --git a/Android.bp b/Android.bp
index 169a818..51bbf93 100644
--- a/Android.bp
+++ b/Android.bp
@@ -21988,6 +21988,7 @@ cc_prebuilt_library_shared {
         },
     },
     compile_multilib: "64",
+    check_elf_files: false,
     prefer: true,
     soc_specific: true,
 }
diff --git a/proprietary/vendor/lib64/libcam.hal3a.v3.so b/proprietary/vendor/lib64/libcam.hal3a.v3.so
index 79aca1b41191be0ad6ddd728f63a8132fd1a3ec1..bf617511d7ee2008c9cb3f6a27a6851114d57888 100644
GIT binary patch
delta 283
zcmcaGWhdhWAZ}=3Y+-6)ZeeL*ZDDI+Z{cX+Y~gC*ZsBR+ZQ<L(|5Kc4S>yKK;{5;g
z!3=l)TLM7F^y?A)>p%kSk^E9hKt}uGYJMOV0AfKP76M{nAQk~)Q6LrrV)5;Zt0lM=
zf^@Byk#y1k>H6#<3B*#{Kf6d9{RauCyU1);caeQ}oPAki5Cg-8qUi|^athmRc;tFP
z4ro7ZEw}x&wY=YUkTKGq<(s5HjQP9@ml%PJ>BamCQ6OdK`4xaz5r~z5SQ&^_fLIlX
d)qq$Xh&6y%6Nt5dSR06SfLM3?d49b{D*!BaZ>9hM

delta 283
zcmcaGWhdhWAZ}=3Y+-6)ZeeL*ZDDI+Z{cX+Y~gC*ZsBR+ZQ<L(|5Kbvp<(-PasGe$
zV1_&YEdd~7`t=C@bs&NENPa0LAftV8H9rsw0I?tt3jwh(5Q_k@C=iPQvH14I)e>9_
zLAut<NIGeNbbWS_1Y)V}pIxMl{(}V6U1YYayU4yf&aTi9#K5qjXnKN!oWgb+9=TqS
z1KLkp%WXexE$_D-WQ_D@`6ek4V?M9KB}O1)dNIF36iC^5egz;_1Y#v1Rt91fAXWup
dH6T_8VhteH1Y#{9)&^o7AlBV}o?oxg3IN(;XhZ-2

diff --git a/proprietary/vendor/lib64/libmtkcam_3rdparty.customer.so b/proprietary/vendor/lib64/libmtkcam_3rdparty.customer.so
index bee863adf1f565460fc7a77a29bc4b548b35c377..43eaa08d5a1b887eb10b1c480774ad78d5048e33 100644
GIT binary patch
delta 53
zcmdmSO<~71g@zW!7N!>F7M3lnm1#`N8mCvMv0ehw+x^p7&6t6V_Vz4RAZFX%p2fcL
F002I#6(0Zq

delta 53
zcmdmSO<~71g@zW!7N!>F7M3lnm1#^04b!XBST6zT?f&VkX3RiFdwUiu5VLJ>&tl(r
F000-L6N&%;