Merge \"DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak\" into mnc-dev (6a258918) · Commits · e / os / android_frameworks_av

camera/ICameraRecordingProxy.cpp

+5 −1

Original line number	Diff line number	Diff line
		@@ -31,6 +31,11 @@ enum {
		RELEASE_RECORDING_FRAME,
		};

		uint8_t ICameraRecordingProxy::baseObject = 0;

		size_t ICameraRecordingProxy::getCommonBaseAddress() {
		return (size_t)&baseObject;
		}

		class BpCameraRecordingProxy: public BpInterface<ICameraRecordingProxy>
		{
		@@ -106,4 +111,3 @@ status_t BnCameraRecordingProxy::onTransact(
		// ----------------------------------------------------------------------------

		}; // namespace android

include/camera/ICameraRecordingProxy.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -83,6 +83,12 @@ public:
		virtual status_t startRecording(const sp<ICameraRecordingProxyListener>& listener) = 0;
		virtual void stopRecording() = 0;
		virtual void releaseRecordingFrame(const sp<IMemory>& mem) = 0;

		// b/28466701
		static size_t getCommonBaseAddress();
		private:

		static uint8_t baseObject;
		};

		// ----------------------------------------------------------------------------

include/media/stagefright/CameraSource.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -236,6 +236,9 @@ private:
		status_t checkFrameRate(const CameraParameters& params,
		int32_t frameRate);

		static void adjustIncomingANWBuffer(IMemory* data);
		static void adjustOutgoingANWBuffer(IMemory* data);

		void stopCameraRecording();
		status_t reset();

media/libstagefright/CameraSource.cpp

+29 −0

Original line number	Diff line number	Diff line
		@@ -27,8 +27,10 @@
		#include <media/stagefright/MediaDefs.h>
		#include <media/stagefright/MediaErrors.h>
		#include <media/stagefright/MetaData.h>
		#include <media/hardware/HardwareAPI.h>
		#include <camera/Camera.h>
		#include <camera/CameraParameters.h>
		#include <camera/ICameraRecordingProxy.h>
		#include <gui/Surface.h>
		#include <utils/String8.h>
		#include <cutils/properties.h>
		@@ -792,6 +794,8 @@ void CameraSource::releaseQueuedFrames() {
		List<sp<IMemory> >::iterator it;
		while (!mFramesReceived.empty()) {
		it = mFramesReceived.begin();
		// b/28466701
		adjustOutgoingANWBuffer(it->get());
		releaseRecordingFrame(*it);
		mFramesReceived.erase(it);
		++mNumFramesDropped;
		@@ -812,6 +816,9 @@ void CameraSource::signalBufferReturned(MediaBuffer *buffer) {
		for (List<sp<IMemory> >::iterator it = mFramesBeingEncoded.begin();
		it != mFramesBeingEncoded.end(); ++it) {
		if ((*it)->pointer() == buffer->data()) {
		// b/28466701
		adjustOutgoingANWBuffer(it->get());

		releaseOneRecordingFrame((*it));
		mFramesBeingEncoded.erase(it);
		++mNumFramesEncoded;
		@@ -917,6 +924,10 @@ void CameraSource::dataCallbackTimestamp(int64_t timestampUs,
		++mNumFramesReceived;

		CHECK(data != NULL && data->size() > 0);

		// b/28466701
		adjustIncomingANWBuffer(data.get());

		mFramesReceived.push_back(data);
		int64_t timeUs = mStartTimeUs + (timestampUs - mFirstFrameTimeUs);
		mFrameTimes.push_back(timeUs);
		@@ -930,6 +941,24 @@ bool CameraSource::isMetaDataStoredInVideoBuffers() const {
		return mIsMetaDataStoredInVideoBuffers;
		}

		void CameraSource::adjustIncomingANWBuffer(IMemory* data) {
		VideoNativeMetadata *payload =
		reinterpret_cast<VideoNativeMetadata*>(data->pointer());
		if (payload->eType == kMetadataBufferTypeANWBuffer) {
		payload->pBuffer = (ANativeWindowBuffer)(((uint8_t)payload->pBuffer) +
		ICameraRecordingProxy::getCommonBaseAddress());
		}
		}

		void CameraSource::adjustOutgoingANWBuffer(IMemory* data) {
		VideoNativeMetadata *payload =
		reinterpret_cast<VideoNativeMetadata*>(data->pointer());
		if (payload->eType == kMetadataBufferTypeANWBuffer) {
		payload->pBuffer = (ANativeWindowBuffer)(((uint8_t)payload->pBuffer) -
		ICameraRecordingProxy::getCommonBaseAddress());
		}
		}

		CameraSource::ProxyListener::ProxyListener(const sp<CameraSource>& source) {
		mSource = source;
		}

services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp

+8 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,7 @@
		#include <utils/Trace.h>
		#include <gui/BufferItem.h>
		#include <gui/Surface.h>
		#include <camera/ICameraRecordingProxy.h>
		#include <media/hardware/HardwareAPI.h>

		#include "common/CameraDeviceBase.h"
		@@ -826,6 +827,9 @@ status_t StreamingProcessor::processRecordingFrame() {
		(uint8_t*)heap->getBase() + offset);
		payload->eType = kMetadataBufferTypeANWBuffer;
		payload->pBuffer = imgBuffer.mGraphicBuffer->getNativeBuffer();
		// b/28466701
		payload->pBuffer = (ANativeWindowBuffer)((uint8_t)payload->pBuffer -
		ICameraRecordingProxy::getCommonBaseAddress());
		payload->nFenceFd = -1;

		ALOGVV("%s: Camera %d: Sending out ANWBuffer %p",
		@@ -874,6 +878,10 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) {
		return;
		}

		// b/28466701
		payload->pBuffer = (ANativeWindowBuffer)(((uint8_t)payload->pBuffer) +
		ICameraRecordingProxy::getCommonBaseAddress());

		// Release the buffer back to the recording queue
		size_t itemIndex;
		for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) {