DO NOT MERGE - Merge qt-qpr1-dev-plus-aosp@6382244 into stag-aosp-master (519ef77d) · Commits · e / os / android_frameworks_av

drm/libmediadrm/IDrm.cpp

+1 −0

Original line number	Diff line number	Diff line
		@@ -1071,6 +1071,7 @@ status_t BnDrm::onTransact(
		Vector<uint8_t> keySetId;
		readVector(data, keySetId);
		DrmPlugin::OfflineLicenseState state;
		state = DrmPlugin::OfflineLicenseState::kOfflineLicenseStateUnknown;
		status_t result = getOfflineLicenseState(keySetId, &state);
		reply->writeInt32(static_cast<DrmPlugin::OfflineLicenseState>(state));
		reply->writeInt32(result);

media/extractors/mp4/MPEG4Extractor.cpp

+52 −11

Original line number	Diff line number	Diff line
		@@ -1060,6 +1060,8 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		// drop it now to reduce our footprint
		free(mLastTrack->mTx3gBuffer);
		mLastTrack->mTx3gBuffer = NULL;
		mLastTrack->mTx3gFilled = 0;
		mLastTrack->mTx3gSize = 0;
		}

		} else if (chunk_type == FOURCC("moov")) {
		@@ -2639,6 +2641,10 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset, int depth) {
		// if those apps are compensating for it, we'd break them with such a change
		//

		if (mLastTrack->mTx3gBuffer == NULL) {
		mLastTrack->mTx3gSize = 0;
		mLastTrack->mTx3gFilled = 0;
		}
		if (mLastTrack->mTx3gSize - mLastTrack->mTx3gFilled < chunk_size) {
		size_t growth = kTx3gGrowth;
		if (growth < chunk_size) {
		@@ -5011,8 +5017,11 @@ status_t MPEG4Source::parseChunk(off64_t *offset) {
		}

		status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		off64_t offset, off64_t /* size */) {
		off64_t offset, off64_t size) {
		ALOGV("parseSampleAuxiliaryInformationSizes");
		if (size < 9) {
		return -EINVAL;
		}
		// 14496-12 8.7.12
		uint8_t version;
		if (mDataSource->readAt(
		@@ -5025,25 +5034,32 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		return ERROR_UNSUPPORTED;
		}
		offset++;
		size--;

		uint32_t flags;
		if (!mDataSource->getUInt24(offset, &flags)) {
		return ERROR_IO;
		}
		offset += 3;
		size -= 3;

		if (flags & 1) {
		if (size < 13) {
		return -EINVAL;
		}
		uint32_t tmp;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_MALFORMED;
		}
		mCurrentAuxInfoType = tmp;
		offset += 4;
		size -= 4;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_MALFORMED;
		}
		mCurrentAuxInfoTypeParameter = tmp;
		offset += 4;
		size -= 4;
		}

		uint8_t defsize;
		@@ -5052,6 +5068,7 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}
		mCurrentDefaultSampleInfoSize = defsize;
		offset++;
		size--;

		uint32_t smplcnt;
		if (!mDataSource->getUInt32(offset, &smplcnt)) {
		@@ -5059,11 +5076,16 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}
		mCurrentSampleInfoCount = smplcnt;
		offset += 4;

		size -= 4;
		if (mCurrentDefaultSampleInfoSize != 0) {
		ALOGV("@@@@ using default sample info size of %d", mCurrentDefaultSampleInfoSize);
		return OK;
		}
		if(smplcnt > size) {
		ALOGW("b/124525515 - smplcnt(%u) > size(%ld)", (unsigned int)smplcnt, (unsigned long)size);
		android_errorWriteLog(0x534e4554, "124525515");
		return -EINVAL;
		}
		if (smplcnt > mCurrentSampleInfoAllocSize) {
		uint8_t * newPtr = (uint8_t*) realloc(mCurrentSampleInfoSizes, smplcnt);
		if (newPtr == NULL) {
		@@ -5079,26 +5101,32 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}

		status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
		off64_t offset, off64_t /* size */) {
		off64_t offset, off64_t size) {
		ALOGV("parseSampleAuxiliaryInformationOffsets");
		if (size < 8) {
		return -EINVAL;
		}
		// 14496-12 8.7.13
		uint8_t version;
		if (mDataSource->readAt(offset, &version, sizeof(version)) != 1) {
		return ERROR_IO;
		}
		offset++;
		size--;

		uint32_t flags;
		if (!mDataSource->getUInt24(offset, &flags)) {
		return ERROR_IO;
		}
		offset += 3;
		size -= 3;

		uint32_t entrycount;
		if (!mDataSource->getUInt32(offset, &entrycount)) {
		return ERROR_IO;
		}
		offset += 4;
		size -= 4;
		if (entrycount == 0) {
		return OK;
		}
		@@ -5124,19 +5152,31 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(

		for (size_t i = 0; i < entrycount; i++) {
		if (version == 0) {
		if (size < 4) {
		ALOGW("b/124526959");
		android_errorWriteLog(0x534e4554, "124526959");
		return -EINVAL;
		}
		uint32_t tmp;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_IO;
		}
		mCurrentSampleInfoOffsets[i] = tmp;
		offset += 4;
		size -= 4;
		} else {
		if (size < 8) {
		ALOGW("b/124526959");
		android_errorWriteLog(0x534e4554, "124526959");
		return -EINVAL;
		}
		uint64_t tmp;
		if (!mDataSource->getUInt64(offset, &tmp)) {
		return ERROR_IO;
		}
		mCurrentSampleInfoOffsets[i] = tmp;
		offset += 8;
		size -= 8;
		}
		}

		@@ -5458,16 +5498,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) {

		// apply some sanity (vs strict legality) checks
		//
		// clamp the count of entries in the trun box, to avoid spending forever parsing
		// this box. Clamping (vs error) lets us play something.
		// 1 million is about 400 msecs on a Pixel3, should be no more than a couple seconds
		// on the slowest devices.
		static constexpr uint32_t kMaxTrunSampleCount = 1000000;
		static constexpr uint32_t kMaxTrunSampleCount = 10000;
		if (sampleCount > kMaxTrunSampleCount) {
		ALOGW("b/123389881 clamp sampleCount(%u) @ kMaxTrunSampleCount(%u)",
		ALOGW("b/123389881 sampleCount(%u) > kMaxTrunSampleCount(%u)",
		sampleCount, kMaxTrunSampleCount);
		android_errorWriteLog(0x534e4554, "124389881 count");

		return -EINVAL;
		}
		}

		@@ -5511,7 +5547,12 @@ status_t MPEG4Source::parseTrackFragmentRun(off64_t offset, off64_t size) {
		tmp.duration = sampleDuration;
		tmp.compositionOffset = sampleCtsOffset;
		memset(tmp.iv, 0, sizeof(tmp.iv));
		mCurrentSamples.add(tmp);
		if (mCurrentSamples.add(tmp) < 0) {
		ALOGW("b/123389881 failed saving sample(n=%zu)", mCurrentSamples.size());
		android_errorWriteLog(0x534e4554, "124389881 allocation");
		mCurrentSamples.clear();
		return NO_MEMORY;
		}

		dataOffset += sampleSize;
		}

media/extractors/mp4/SampleTable.cpp

+7 −10

Original line number	Diff line number	Diff line
		@@ -391,20 +391,11 @@ status_t SampleTable::setTimeToSampleParams(
		}

		mTimeToSampleCount = U32_AT(&header[4]);
		if (mTimeToSampleCount > UINT32_MAX / (2 * sizeof(uint32_t))) {
		// Choose this bound because
		// 1) 2 * sizeof(uint32_t) is the amount of memory needed for one
		// time-to-sample entry in the time-to-sample table.
		// 2) mTimeToSampleCount is the number of entries of the time-to-sample
		// table.
		// 3) We hope that the table size does not exceed UINT32_MAX.
		if (mTimeToSampleCount > (data_size - 8) / (2 * sizeof(uint32_t))) {
		ALOGE("Time-to-sample table size too large.");
		return ERROR_OUT_OF_RANGE;
		}

		// Note: At this point, we know that mTimeToSampleCount * 2 will not
		// overflow because of the above condition.

		uint64_t allocSize = (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t);
		mTotalSize += allocSize;
		if (mTotalSize > kMaxTotalSize) {
		@@ -540,6 +531,12 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)
		}

		uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);
		if (allocSize > data_size - 8) {
		ALOGW("b/124771364 - allocSize(%lu) > size(%lu)",
		(unsigned long)allocSize, (unsigned long)(data_size - 8));
		android_errorWriteLog(0x534e4554, "124771364");
		return ERROR_MALFORMED;
		}
		if (allocSize > kMaxTotalSize) {
		ALOGE("Sync sample table size too large.");
		return ERROR_OUT_OF_RANGE;

media/libaaudio/src/binding/IAAudioService.cpp

+57 −16

Original line number	Diff line number	Diff line
		@@ -237,12 +237,12 @@ IMPLEMENT_META_INTERFACE(AAudioService, "IAAudioService");

		status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,
		Parcel* reply, uint32_t flags) {
		aaudio_handle_t streamHandle;
		aaudio_handle_t streamHandle = 0;
		aaudio::AAudioStreamRequest request;
		aaudio::AAudioStreamConfiguration configuration;
		pid_t tid;
		int64_t nanoseconds;
		aaudio_result_t result;
		pid_t tid = 0;
		int64_t nanoseconds = 0;
		aaudio_result_t result = AAUDIO_OK;
		status_t status = NO_ERROR;
		ALOGV("BnAAudioService::onTransact(%i) %i", code, flags);

		@@ -285,7 +285,11 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case CLOSE_STREAM: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(CLOSE_STREAM) streamHandle failed!", __func__);
		return status;
		}
		result = closeStream(streamHandle);
		//ALOGD("BnAAudioService::onTransact CLOSE_STREAM 0x%08X, result = %d",
		// streamHandle, result);
		@@ -297,6 +301,7 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,
		CHECK_INTERFACE(IAAudioService, data, reply);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(GET_STREAM_DESCRIPTION) streamHandle failed!", __func__);
		return status;
		}
		aaudio::AudioEndpointParcelable parcelable;
		@@ -313,7 +318,11 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case START_STREAM: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(START_STREAM) streamHandle failed!", __func__);
		return status;
		}
		result = startStream(streamHandle);
		ALOGV("BnAAudioService::onTransact START_STREAM 0x%08X, result = %d",
		streamHandle, result);
		@@ -323,7 +332,11 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case PAUSE_STREAM: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(PAUSE_STREAM) streamHandle failed!", __func__);
		return status;
		}
		result = pauseStream(streamHandle);
		ALOGV("BnAAudioService::onTransact PAUSE_STREAM 0x%08X, result = %d",
		streamHandle, result);
		@@ -333,7 +346,11 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case STOP_STREAM: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(STOP_STREAM) streamHandle failed!", __func__);
		return status;
		}
		result = stopStream(streamHandle);
		ALOGV("BnAAudioService::onTransact STOP_STREAM 0x%08X, result = %d",
		streamHandle, result);
		@@ -343,7 +360,11 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case FLUSH_STREAM: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(FLUSH_STREAM) streamHandle failed!", __func__);
		return status;
		}
		result = flushStream(streamHandle);
		ALOGV("BnAAudioService::onTransact FLUSH_STREAM 0x%08X, result = %d",
		streamHandle, result);
		@@ -353,20 +374,40 @@ status_t BnAAudioService::onTransact(uint32_t code, const Parcel& data,

		case REGISTER_AUDIO_THREAD: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		data.readInt32(&tid);
		data.readInt64(&nanoseconds);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(REGISTER_AUDIO_THREAD) streamHandle failed!", __func__);
		return status;
		}
		status = data.readInt32(&tid);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(REGISTER_AUDIO_THREAD) tid failed!", __func__);
		return status;
		}
		status = data.readInt64(&nanoseconds);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(REGISTER_AUDIO_THREAD) nanoseconds failed!", __func__);
		return status;
		}
		result = registerAudioThread(streamHandle, tid, nanoseconds);
		ALOGV("BnAAudioService::onTransact REGISTER_AUDIO_THREAD 0x%08X, result = %d",
		streamHandle, result);
		ALOGV("BnAAudioService::%s(REGISTER_AUDIO_THREAD) 0x%08X, result = %d",
		__func__, streamHandle, result);
		reply->writeInt32(result);
		return NO_ERROR;
		} break;

		case UNREGISTER_AUDIO_THREAD: {
		CHECK_INTERFACE(IAAudioService, data, reply);
		data.readInt32(&streamHandle);
		data.readInt32(&tid);
		status = data.readInt32(&streamHandle);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(UNREGISTER_AUDIO_THREAD) streamHandle failed!", __func__);
		return status;
		}
		status = data.readInt32(&tid);
		if (status != NO_ERROR) {
		ALOGE("BnAAudioService::%s(UNREGISTER_AUDIO_THREAD) tid failed!", __func__);
		return status;
		}
		result = unregisterAudioThread(streamHandle, tid);
		ALOGV("BnAAudioService::onTransact UNREGISTER_AUDIO_THREAD 0x%08X, result = %d",
		streamHandle, result);

media/libstagefright/foundation/OpusHeader.cpp

+4 −0

Original line number	Diff line number	Diff line
		@@ -300,6 +300,10 @@ bool GetOpusHeaderBuffers(const uint8_t *data, size_t data_size,
		*opusHeadSize = data_size;
		return true;
		} else if (memcmp(AOPUS_CSD_MARKER_PREFIX, data, AOPUS_CSD_MARKER_PREFIX_SIZE) == 0) {
		if (data_size < AOPUS_UNIFIED_CSD_MINSIZE \|\| data_size > AOPUS_UNIFIED_CSD_MAXSIZE) {
		ALOGD("Unexpected size for unified opus csd %zu", data_size);
		return false;
		}
		size_t i = 0;
		bool found = false;
		while (i <= data_size - AOPUS_MARKER_SIZE - AOPUS_LENGTH_SIZE) {