Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit ec22f455 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-11.0.0_r38' into staging/lineage-18.1_merge-android-11.0.0_r38 

Android 11.0.0 Release 38 (RQ3A.210605.005)

* tag 'android-11.0.0_r38':
  [RESTRICT AUTOMERGE]Fix CryptoPlugin use after free vulnerability.
  [RESTRICT AUTOMERGE] Fix clearkey CryptoPlugin use after free vulnerability.
  cameraserver: Enforce system camera rules for setTorchMode and torch callbacks.
  Modify MediaRecorder stopping process to avoid blocking
  C2SoftAvcEnc: Use dimensions from mSize instead of input buffer
  Revert "CCodecConfig: don't dup input format"
  aaudio: fix race when disconnecting
  aaudio: lock transport methods
  [RESTRICT AUTOMERGE] Fix possible uaf of play policy state
  mediautils : TimeCheck: fix OOB access
  [RESTRICT AUTOMERGE] Fix UAF in clearkey service's MemoryFileSystem
  Fix UAF in clearkey service's MemoryFileSystem
  Fix potential decrypt destPtr overflow.
  [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow.
  Prevent read of uninitialized memory
  Prevent read of uninitialized memory
  Prevent read of uninitialized memory
  mp3dec: Changes in the fillMainDataBuf function
  Rephrase to avoid integer overflow
  Fix possible uaf of play policy state
  Fix double free of play policy in a race condition.
  Add a null check in RTSPSource::stop
  Valid pitch value is required to prevent out of bound access
  Fix potential decrypt src pointer overflow.
  mpeg4enc: fix OOB in RasterIntraUpdate
  Improve handling MediaCodec linkToDeath() resource manager
  Codec2: Initialize InputSurfaceWrapper::Config structure fields
  Camera: Fix deadlock in ACameraCaptureSession destructor
  m4v_h263: Add check on the encode dimension
  ACodec: Reduce the TWOmxNode wrapper in GraphicBufferSource

Conflicts:
	drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h

Change-Id: I24a4de763f8f91baddc517491313d6ada6514c79
parents 7d7dec0c e5fca2f4

camera/ndk/impl/ACameraDevice.cpp

+31 −29
Original line number Diff line number Diff line
@@ -1361,31 +1361,11 @@ CameraDevice::checkAndFireSequenceCompleteLocked() { 
                it->second.isSequenceCompleted = true;

            }



            if (it->second.isSequenceCompleted && hasCallback) {

                auto cbIt = mSequenceCallbackMap.find(sequenceId);

                CallbackHolder cbh = cbIt->second;



                // send seq complete callback

                sp<AMessage> msg = new AMessage(kWhatCaptureSeqEnd, mHandler);

                msg->setPointer(kContextKey, cbh.mContext);

                msg->setObject(kSessionSpKey, cbh.mSession);

                msg->setPointer(kCallbackFpKey, (void*) cbh.mOnCaptureSequenceCompleted);

                msg->setInt32(kSequenceIdKey, sequenceId);

                msg->setInt64(kFrameNumberKey, lastFrameNumber);



                // Clear the session sp before we send out the message

                // This will guarantee the rare case where the message is processed

                // before cbh goes out of scope and causing we call the session

                // destructor while holding device lock

                cbh.mSession.clear();

                postSessionMsgAndCleanup(msg);

            }

        }



        if (it->second.isSequenceCompleted && it->second.isInflightCompleted) {

            if (mSequenceCallbackMap.find(sequenceId) != mSequenceCallbackMap.end()) {

                mSequenceCallbackMap.erase(sequenceId);

            }

            sendCaptureSequenceCompletedLocked(sequenceId, lastFrameNumber);



            it = mSequenceLastFrameNumberMap.erase(it);

            ALOGV("%s: Remove holder for sequenceId %d", __FUNCTION__, sequenceId);

        } else {
@@ -1412,13 +1392,7 @@ CameraDevice::removeCompletedCallbackHolderLocked(int64_t lastCompletedRegularFr 
                lastCompletedRegularFrameNumber);

        if (lastFrameNumber <= lastCompletedRegularFrameNumber) {

            if (it->second.isSequenceCompleted) {

                // Check if there is callback for this sequence

                // This should not happen because we always register callback (with nullptr inside)

                if (mSequenceCallbackMap.count(sequenceId) == 0) {

                    ALOGW("No callback found for sequenceId %d", sequenceId);

                } else {

                    mSequenceCallbackMap.erase(sequenceId);

                }

                sendCaptureSequenceCompletedLocked(sequenceId, lastFrameNumber);



                it = mSequenceLastFrameNumberMap.erase(it);

                ALOGV("%s: Remove holder for sequenceId %d", __FUNCTION__, sequenceId);
@@ -1709,5 +1683,33 @@ CameraDevice::ServiceCallback::onRepeatingRequestError( 
    return ret;

}



void

CameraDevice::sendCaptureSequenceCompletedLocked(int sequenceId, int64_t lastFrameNumber) {

    auto cbIt = mSequenceCallbackMap.find(sequenceId);

    if (cbIt != mSequenceCallbackMap.end()) {

        CallbackHolder cbh = cbIt->second;

        mSequenceCallbackMap.erase(cbIt);



        // send seq complete callback

        sp<AMessage> msg = new AMessage(kWhatCaptureSeqEnd, mHandler);

        msg->setPointer(kContextKey, cbh.mContext);

        msg->setObject(kSessionSpKey, cbh.mSession);

        msg->setPointer(kCallbackFpKey, (void*) cbh.mOnCaptureSequenceCompleted);

        msg->setInt32(kSequenceIdKey, sequenceId);

        msg->setInt64(kFrameNumberKey, lastFrameNumber);



        // Clear the session sp before we send out the message

        // This will guarantee the rare case where the message is processed

        // before cbh goes out of scope and causing we call the session

        // destructor while holding device lock

        cbh.mSession.clear();

        postSessionMsgAndCleanup(msg);

    } else {

        // Check if there is callback for this sequence

        // This should not happen because we always register callback (with nullptr inside)

        ALOGW("No callback found for sequenceId %d", sequenceId);

    }

}



} // namespace acam

} // namespace android

camera/ndk/impl/ACameraDevice.h

+1 −0
Original line number Diff line number Diff line
@@ -354,6 +354,7 @@ class CameraDevice final : public RefBase { 
    void checkRepeatingSequenceCompleteLocked(const int sequenceId, const int64_t lastFrameNumber);

    void checkAndFireSequenceCompleteLocked();

    void removeCompletedCallbackHolderLocked(int64_t lastCompletedRegularFrameNumber);

    void sendCaptureSequenceCompletedLocked(int sequenceId, int64_t lastFrameNumber);



    // Misc variables

    int32_t mShadingMapSize[2];   // const after constructor

drm/mediadrm/plugins/clearkey/default/DrmPlugin.cpp

+1 −0
Original line number Diff line number Diff line
@@ -207,6 +207,7 @@ status_t DrmPlugin::queryKeyStatus( 
    }



    infoMap.clear();

    android::Mutex::Autolock lock(mPlayPolicyLock);

    for (size_t i = 0; i < mPlayPolicy.size(); ++i) {

        infoMap.add(mPlayPolicy.keyAt(i), mPlayPolicy.valueAt(i));

    }

drm/mediadrm/plugins/clearkey/default/include/DrmPlugin.h

+1 −1
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ private: 
    void initProperties();

    void setPlayPolicy();



    android::Mutex mPlayPolicyLock;

    mutable android::Mutex mPlayPolicyLock;

    android::KeyedVector<String8, String8> mPlayPolicy;

    android::KeyedVector<String8, String8> mStringProperties;

    android::KeyedVector<String8, Vector<uint8_t>> mByteArrayProperties;

drm/mediadrm/plugins/clearkey/hidl/Android.bp

+1 −1
Original line number Diff line number Diff line
@@ -37,7 +37,7 @@ cc_defaults { 


    relative_install_path: "hw",



    cflags: ["-Wall", "-Werror"],

    cflags: ["-Wall", "-Werror", "-Wthread-safety"],



    shared_libs: [

        "android.hardware.drm@1.0",