Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edd6ca3e authored by Jessica Wagantall's avatar Jessica Wagantall
Browse files

Merge tag 'android-6.0.1_r17' into HEAD 

Android 6.0.1 release 17
Ticket: CYNGNOS-1854
parents 808632f7 38f1da38

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

+4 −1
Original line number Diff line number Diff line
@@ -3104,7 +3104,10 @@ int Effect_command(effect_handle_t self, 
            //ALOGV("\tEffect_command cmdCode Case: EFFECT_CMD_GET_PARAM start");



            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||

media/libeffects/lvm/wrapper/Reverb/EffectReverb.cpp

+4 −1
Original line number Diff line number Diff line
@@ -1956,7 +1956,10 @@ int Reverb_command(effect_handle_t self, 
            //ALOGV("\tReverb_command cmdCode Case: "

            //        "EFFECT_CMD_GET_PARAM start");

            effect_param_t *p = (effect_param_t *)pCmdData;



            if (SIZE_MAX - sizeof(effect_param_t) < (size_t)p->psize) {

                android_errorWriteLog(0x534e4554, "26347509");

                return -EINVAL;

            }

            if (pCmdData == NULL || cmdSize < sizeof(effect_param_t) ||

                    cmdSize < (sizeof(effect_param_t) + p->psize) ||

                    pReplyData == NULL || replySize == NULL ||

media/libstagefright/MPEG4Extractor.cpp

+9 −1
Original line number Diff line number Diff line
@@ -4575,7 +4575,15 @@ status_t MPEG4Source::fragmentedRead( 
                    continue;

                }



                CHECK(dstOffset + 4 <= mBuffer->size());

                if (dstOffset > SIZE_MAX - 4 ||

                        dstOffset + 4 > SIZE_MAX - nalLength ||

                        dstOffset + 4 + nalLength > mBuffer->size()) {

                    ALOGE("b/26365349 : %zu %zu", dstOffset, mBuffer->size());

                    android_errorWriteLog(0x534e4554, "26365349");

                    mBuffer->release();

                    mBuffer = NULL;

                    return ERROR_MALFORMED;

                }



                dstData[dstOffset++] = 0;

                dstData[dstOffset++] = 0;

services/camera/libcameraservice/CameraService.cpp

+9 −1
Original line number Diff line number Diff line
@@ -1944,6 +1944,14 @@ void CameraService::BasicClient::disconnect() { 
    mClientPid = 0;

}



status_t CameraService::BasicClient::dump(int, const Vector<String16>&) {

    // No dumping of clients directly over Binder,

    // must go through CameraService::dump

    android_errorWriteWithInfoLog(SN_EVENT_LOG_ID, "26265403",

            IPCThreadState::self()->getCallingUid(), NULL, 0);

    return OK;

}



String16 CameraService::BasicClient::getPackageName() const {

    return mClientPackageName;

}
@@ -2396,7 +2404,7 @@ status_t CameraService::dump(int fd, const Vector<String16>& args) { 
                    String8(client->getPackageName()).string());

            write(fd, result.string(), result.size());



            client->dump(fd, args);

            client->dumpClient(fd, args);

        }



        if (stateLocked) mCameraStatesLock.unlock();

services/camera/libcameraservice/CameraService.h

+7 −1
Original line number Diff line number Diff line
@@ -91,6 +91,9 @@ public: 
    // Default number of messages to store in eviction log

    static const size_t DEFAULT_EVENT_LOG_LENGTH = 100;



    // Event log ID

    static const int SN_EVENT_LOG_ID = 0x534e4554;



    // Implementation of BinderService<T>

    static char const* getServiceName() { return "media.camera"; }
@@ -205,7 +208,10 @@ public: 
            return mRemoteBinder;

        }



        virtual status_t    dump(int fd, const Vector<String16>& args) = 0;

        // Disallows dumping over binder interface

        virtual status_t      dump(int fd, const Vector<String16>& args);

        // Internal dump method to be called by CameraService

        virtual status_t      dumpClient(int fd, const Vector<String16>& args) = 0;



        // Return the package name for this client

        virtual String16 getPackageName() const;