Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 4b550589 authored by Kevin F. Haggerty's avatar Kevin F. Haggerty
Browse files

Merge tag 'android-9.0.0_r54' into staging/lineage-16.0_merge-android-9.0.0_r54 

Android 9.0.0 release 54

* tag 'android-9.0.0_r54':
  Restrict Automerge: Fix reinterpret_cast security bug

Change-Id: I2add67d198ef3f78daa8a4cbf4b13edf8a106210
parents 5c2b1857 e71f0044

libs/gui/include/gui/SurfaceControl.h

+4 −6
Original line number Diff line number Diff line
@@ -76,6 +76,10 @@ public: 


    sp<SurfaceComposerClient> getClient() const;



    SurfaceControl(const sp<SurfaceComposerClient>& client,

                   const sp<IBinder>& handle,

                   const sp<IGraphicBufferProducer>& gbp,

                   bool owned);

private:

    // can't be copied

    SurfaceControl& operator = (SurfaceControl& rhs);
@@ -84,12 +88,6 @@ private: 
    friend class SurfaceComposerClient;

    friend class Surface;



    SurfaceControl(

            const sp<SurfaceComposerClient>& client,

            const sp<IBinder>& handle,

            const sp<IGraphicBufferProducer>& gbp,

            bool owned);



    ~SurfaceControl();



    sp<Surface> generateSurfaceLocked() const;

services/surfaceflinger/Client.cpp

+6 −22
Original line number Diff line number Diff line
@@ -118,7 +118,6 @@ sp<Layer> Client::getLayerUser(const sp<IBinder>& handle) const 
    return lbc;

}





status_t Client::onTransact(

    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)

{
@@ -144,34 +143,19 @@ status_t Client::onTransact( 
     return BnSurfaceComposerClient::onTransact(code, data, reply, flags);

}





status_t Client::createSurface(

        const String8& name,

        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,

        const sp<IBinder>& parentHandle, int32_t windowType, int32_t ownerUid,

        sp<IBinder>* handle,

        sp<IGraphicBufferProducer>* gbp)

{

    sp<Layer> parent = nullptr;

    if (parentHandle != nullptr) {

        auto layerHandle = reinterpret_cast<Layer::Handle*>(parentHandle.get());

        parent = layerHandle->owner.promote();

        if (parent == nullptr) {

            return NAME_NOT_FOUND;

        }

    }

    if (parent == nullptr) {

        sp<IGraphicBufferProducer>* gbp) {

    bool parentDied;

        parent = getParentLayer(&parentDied);

        // If we had a parent, but it died, we've lost all

        // our capabilities.

        if (parentDied) {

    sp<Layer> parentLayer = getParentLayer(&parentDied);

    if (parentHandle == nullptr && parentDied) {

        return NAME_NOT_FOUND;

    }

    }



    return mFlinger->createLayer(name, this, w, h, format, flags, windowType,

                                 ownerUid, handle, gbp, &parent);

                                 ownerUid, handle, gbp, parentHandle, parentLayer);

}



status_t Client::destroySurface(const sp<IBinder>& handle) {

services/surfaceflinger/Client.h

+1 −1
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ private: 
    virtual status_t createSurface(

            const String8& name,

            uint32_t w, uint32_t h,PixelFormat format, uint32_t flags,

            const sp<IBinder>& parent, int32_t windowType, int32_t ownerUid,

            const sp<IBinder>& parentHandle, int32_t windowType, int32_t ownerUid,

            sp<IBinder>* handle,

            sp<IGraphicBufferProducer>* gbp);

services/surfaceflinger/Layer.cpp

+11 −2
Original line number Diff line number Diff line
@@ -162,10 +162,14 @@ Layer::~Layer() { 
void Layer::onLayerDisplayed(const sp<Fence>& /*releaseFence*/) {}



void Layer::onRemovedFromCurrentState() {

    if (!mPendingRemoval) {

        // the layer is removed from SF mCurrentState to mLayersPendingRemoval



        mPendingRemoval = true;



        // remove from sf mapping

        mFlinger->removeLayerFromMap(this);

    }



    if (mCurrentState.zOrderRelativeOf != nullptr) {

        sp<Layer> strongRelative = mCurrentState.zOrderRelativeOf.promote();

        if (strongRelative != nullptr) {
@@ -205,6 +209,11 @@ bool Layer::getPremultipledAlpha() const { 


sp<IBinder> Layer::getHandle() {

    Mutex::Autolock _l(mLock);

    if (mGetHandleCalled) {

        ALOGE("Get handle called twice" );

        return nullptr;

    }

    mGetHandleCalled = true;

    return new Handle(mFlinger, this);

}

services/surfaceflinger/Layer.h

+3 −0
Original line number Diff line number Diff line
@@ -701,6 +701,8 @@ public: 
        wp<Layer> owner;

    };



    // Creates a new handle each time, so we only expect

    // this to be called once.

    sp<IBinder> getHandle();

    const String8& getName() const;

    virtual void notifyAvailableFrames() {}
@@ -803,6 +805,7 @@ private: 
                                       const LayerVector::Visitor& visitor);

    LayerVector makeChildrenTraversalList(LayerVector::StateSet stateSet,

                                          const std::vector<Layer*>& layersInTree);

    bool mGetHandleCalled = false;

};



// ---------------------------------------------------------------------------