cameras_qcom: fix dangling pointer in fill_frame_image (#19891)

selfdrive/camerad/cameras/camera_common.cc

@@ -216,7 +216,7 @@ void fill_frame_data(cereal::FrameData::Builder &framed, const FrameMetadata &fr
   framed.setGainFrac(frame_data.gain_frac);
 }
 
-void fill_frame_image(cereal::FrameData::Builder &framed, const CameraBuf *b) {
+kj::Array<uint8_t> get_frame_image(const CameraBuf *b) {
   assert(b->cur_rgb_buf);
   const uint8_t *dat = (const uint8_t *)b->cur_rgb_buf->addr;
   int scale = env_scale;
@@ -225,16 +225,15 @@ void fill_frame_image(cereal::FrameData::Builder &framed, const CameraBuf *b) {
   if (env_ymax != -1) y_max = env_ymax;
   int new_width = (x_max - x_min + 1) / scale;
   int new_height = (y_max - y_min + 1) / scale;
-  uint8_t *resized_dat = new uint8_t[new_width*new_height*3];
-
+  kj::Array<uint8_t> frame_image = kj::heapArray<uint8_t>(new_width*new_height*3);
+  uint8_t *resized_dat = frame_image.begin();
   int goff = x_min*3 + y_min*b->rgb_stride;
   for (int r=0;r<new_height;r++) {
     for (int c=0;c<new_width;c++) {
       memcpy(&resized_dat[(r*new_width+c)*3], &dat[goff+r*b->rgb_stride*scale+c*3*scale], 3*sizeof(uint8_t));
     }
   }
-  framed.setImage(kj::arrayPtr((const uint8_t*)resized_dat, (size_t)new_width*new_height*3));
-  delete[] resized_dat;
+  return kj::mv(frame_image);
 }
 
 static void publish_thumbnail(PubMaster *pm, const CameraBuf *b) {
@@ -410,7 +409,7 @@ void common_camera_process_front(SubMaster *sm, PubMaster *pm, CameraState *c, i
   framed.setFrameType(cereal::FrameData::FrameType::FRONT);
   fill_frame_data(framed, b->cur_frame_data, cnt);
   if (env_send_front) {
-    fill_frame_image(framed, b);
+    framed.setImage(get_frame_image(b));
   }
   pm->send("frontFrame", msg);
 }

selfdrive/camerad/cameras/camera_common.h

@@ -132,7 +132,7 @@ public:
 typedef void (*process_thread_cb)(MultiCameraState *s, CameraState *c, int cnt);
 
 void fill_frame_data(cereal::FrameData::Builder &framed, const FrameMetadata &frame_data, uint32_t cnt);
-void fill_frame_image(cereal::FrameData::Builder &framed, const CameraBuf *b);
+kj::Array<uint8_t> get_frame_image(const CameraBuf *b);
 void set_exposure_target(CameraState *c, const uint8_t *pix_ptr, int x_start, int x_end, int x_skip, int y_start, int y_end, int y_skip);
 std::thread start_process_thread(MultiCameraState *cameras, const char *tname,
                                  CameraState *cs, process_thread_cb callback);

selfdrive/camerad/cameras/camera_qcom.cc

@@ -1658,7 +1658,7 @@ void camera_process_frame(MultiCameraState *s, CameraState *c, int cnt) {
   auto framed = msg.initEvent().initFrame();
   fill_frame_data(framed, b->cur_frame_data, cnt);
   if (env_send_rear) {
-    fill_frame_image(framed, b);
+    framed.setImage(get_frame_image(b));
   }
   framed.setFocusVal(s->rear.focus);
   framed.setFocusConf(s->rear.confidence);

selfdrive/camerad/cameras/camera_qcom2.cc

@@ -1103,7 +1103,7 @@ void camera_process_frame(MultiCameraState *s, CameraState *c, int cnt) {
   auto framed = c == &s->rear ? msg.initEvent().initFrame() : msg.initEvent().initWideFrame();
   fill_frame_data(framed, b->cur_frame_data, cnt);
   if ((c == &s->rear && env_send_rear) || (c == &s->wide && env_send_wide)) {
-    fill_frame_image(framed, b);
+    framed.setImage(get_frame_image(b));
   }
   if (c == &s->rear) {
     framed.setTransform(b->yuv_transform.v);