Merge "IOMX: work against metadata buffer spoofing" into mnc-dev (030fbd48) · Commits · e / os / android_frameworks_av

include/media/IOMX.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -107,7 +107,7 @@ public:
		// Use \|params\| as an OMX buffer, but limit the size of the OMX buffer to \|allottedSize\|.
		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) = 0;
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess = OMX_FALSE) = 0;

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -149,7 +149,7 @@ public:
		// may be larger.
		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) = 0;
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess = OMX_FALSE) = 0;

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer) = 0;

media/libmedia/IOMX.cpp

+9 −5

Original line number	Diff line number	Diff line
		@@ -248,7 +248,7 @@ public:

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) {
		buffer_id buffer, OMX_U32 allottedSize, OMX_BOOL / crossProcess */) {
		Parcel data, reply;
		data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
		data.writeInt32((int32_t)node);
		@@ -481,7 +481,7 @@ public:

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) {
		buffer_id buffer, OMX_U32 allottedSize, OMX_BOOL / crossProcess */) {
		Parcel data, reply;
		data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
		data.writeInt32((int32_t)node);
		@@ -834,7 +834,8 @@ status_t BnOMX::onTransact(
		OMX_U32 allottedSize = data.readInt32();

		buffer_id buffer;
		status_t err = useBuffer(node, port_index, params, &buffer, allottedSize);
		status_t err = useBuffer(
		node, port_index, params, &buffer, allottedSize, OMX_TRUE /* crossProcess */);
		reply->writeInt32(err);

		if (err == OK) {
		@@ -969,7 +970,10 @@ status_t BnOMX::onTransact(
		OMX_BOOL enable = (OMX_BOOL)data.readInt32();

		MetadataBufferType type = kMetadataBufferTypeInvalid;
		status_t err = storeMetaDataInBuffers(node, port_index, enable, &type);
		status_t err =
		// only control output metadata via Binder
		port_index != 1 /* kOutputPortIndex */ ? BAD_VALUE :
		storeMetaDataInBuffers(node, port_index, enable, &type);

		reply->writeInt32(type);
		reply->writeInt32(err);
		@@ -1054,7 +1058,7 @@ status_t BnOMX::onTransact(

		buffer_id buffer;
		status_t err = allocateBufferWithBackup(
		node, port_index, params, &buffer, allottedSize);
		node, port_index, params, &buffer, allottedSize, OMX_TRUE /* crossProcess */);

		reply->writeInt32(err);

media/libstagefright/OMXClient.cpp

+7 −6

Original line number	Diff line number	Diff line
		@@ -90,7 +90,7 @@ struct MuxOMX : public IOMX {

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize);
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -120,7 +120,7 @@ struct MuxOMX : public IOMX {

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize);
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer);
		@@ -322,8 +322,9 @@ status_t MuxOMX::getGraphicBufferUsage(

		status_t MuxOMX::useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) {
		return getOMX(node)->useBuffer(node, port_index, params, buffer, allottedSize);
		buffer_id buffer, OMX_U32 allottedSize, OMX_BOOL / crossProcess */) {
		return getOMX(node)->useBuffer(
		node, port_index, params, buffer, allottedSize, OMX_FALSE /* crossProcess */);
		}

		status_t MuxOMX::useGraphicBuffer(
		@@ -375,9 +376,9 @@ status_t MuxOMX::allocateBuffer(

		status_t MuxOMX::allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize) {
		buffer_id buffer, OMX_U32 allottedSize, OMX_BOOL / crossProcess */) {
		return getOMX(node)->allocateBufferWithBackup(
		node, port_index, params, buffer, allottedSize);
		node, port_index, params, buffer, allottedSize, OMX_FALSE /* crossProcess */);
		}

		status_t MuxOMX::freeBuffer(

media/libstagefright/include/OMX.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -81,7 +81,7 @@ public:

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize);
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -113,7 +113,7 @@ public:

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer, OMX_U32 allottedSize);
		buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer);

media/libstagefright/include/OMXNodeInstance.h

+8 −2

Original line number	Diff line number	Diff line
		@@ -21,6 +21,7 @@
		#include "OMX.h"

		#include <utils/RefBase.h>
		#include <utils/SortedVector.h>
		#include <utils/threads.h>

		namespace android {
		@@ -71,7 +72,7 @@ struct OMXNodeInstance {

		status_t useBuffer(
		OMX_U32 portIndex, const sp<IMemory> &params,
		OMX::buffer_id *buffer, OMX_U32 allottedSize);
		OMX::buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		status_t useGraphicBuffer(
		OMX_U32 portIndex, const sp<GraphicBuffer> &graphicBuffer,
		@@ -101,7 +102,7 @@ struct OMXNodeInstance {

		status_t allocateBufferWithBackup(
		OMX_U32 portIndex, const sp<IMemory> &params,
		OMX::buffer_id *buffer, OMX_U32 allottedSize);
		OMX::buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);

		status_t freeBuffer(OMX_U32 portIndex, OMX::buffer_id buffer);

		@@ -146,6 +147,9 @@ private:
		OMX_HANDLETYPE mHandle;
		sp<IOMXObserver> mObserver;
		bool mDying;
		bool mSailed; // configuration is set (no more meta-mode changes)
		bool mQueriedProhibitedExtensions;
		SortedVector<OMX_INDEXTYPE> mProhibitedExtensions;
		bool mIsSecure;

		// Lock only covers mGraphicBufferSource. We can't always use mLock
		@@ -191,6 +195,8 @@ private:
		OMX::buffer_id findBufferID(OMX_BUFFERHEADERTYPE *bufferHeader);
		void invalidateBufferID(OMX::buffer_id buffer);

		bool isProhibitedIndex_l(OMX_INDEXTYPE index);

		status_t useGraphicBuffer2_l(
		OMX_U32 portIndex, const sp<GraphicBuffer> &graphicBuffer,
		OMX::buffer_id *buffer);