Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86369364 authored by Lajos Molnar's avatar Lajos Molnar
Browse files

DO NOT MERGE: IOMX: work against metadata buffer spoofing 

- Prohibit direct set/getParam/Settings for extensions meant for
  OMXNodeInstance alone. This disallows enabling metadata mode
  without the knowledge of OMXNodeInstance.
- Do not share metadata mode buffers cross process.
- Disallow setting up metadata mode/tunneling/input surface
  after first sendCommand. (Except to Idle state for OMXCodec quirk.)
- Disallow store-meta for input cross process.
- Disallow emptyBuffer for surface input (via IOMX).
- Fix checking for input surface.

[backported from L-MR1]

Bug: 29422020
Change-Id: I801c77b80e703903f62e42d76fd2e76a34e4bc8e
parent 8f4b1a7d

include/media/IOMX.h

+2 −2
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ public: 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer) = 0;

            buffer_id *buffer, OMX_BOOL crossProcess = OMX_FALSE) = 0;



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -125,7 +125,7 @@ public: 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer) = 0;

            buffer_id *buffer, OMX_BOOL crossProcess = OMX_FALSE) = 0;



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer) = 0;

media/libmedia/IOMX.cpp

+9 −5
Original line number Diff line number Diff line
@@ -245,7 +245,7 @@ public: 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer) {

            buffer_id *buffer, OMX_BOOL /* crossProcess */) {

        Parcel data, reply;

        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());

        data.writeInt32((int32_t)node);
@@ -415,7 +415,7 @@ public: 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer) {

            buffer_id *buffer, OMX_BOOL /* crossProcess */) {

        Parcel data, reply;

        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());

        data.writeInt32((int32_t)node);
@@ -757,7 +757,8 @@ status_t BnOMX::onTransact( 
                interface_cast<IMemory>(data.readStrongBinder());



            buffer_id buffer;

            status_t err = useBuffer(node, port_index, params, &buffer);

            status_t err = useBuffer(

                    node, port_index, params, &buffer, OMX_TRUE /* crossProcess */);

            reply->writeInt32(err);



            if (err == OK) {
@@ -845,7 +846,10 @@ status_t BnOMX::onTransact( 
            OMX_U32 port_index = data.readInt32();

            OMX_BOOL enable = (OMX_BOOL)data.readInt32();



            status_t err = storeMetaDataInBuffers(node, port_index, enable);

            status_t err =

                // only control output metadata via Binder

                port_index != 1 /* kOutputPortIndex */ ? BAD_VALUE :

                storeMetaDataInBuffers(node, port_index, enable);

            reply->writeInt32(err);



            return NO_ERROR;
@@ -927,7 +931,7 @@ status_t BnOMX::onTransact( 


            buffer_id buffer;

            status_t err = allocateBufferWithBackup(

                    node, port_index, params, &buffer);

                    node, port_index, params, &buffer, OMX_TRUE /* crossProcess */);



            reply->writeInt32(err);

media/libstagefright/ACodec.cpp

+2 −1
Original line number Diff line number Diff line
@@ -984,7 +984,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() { 
        VideoDecoderOutputMetaData *metaData =

            reinterpret_cast<VideoDecoderOutputMetaData *>(

                    oldest->mData->base());

        CHECK_EQ(metaData->eType, kMetadataBufferTypeGrallocSource);

        // metaData is only readable if codec is in the same process

        //CHECK_EQ(metaData->eType, kMetadataBufferTypeGrallocSource);



        ALOGV("replaced oldest buffer #%u with age %u (%p/%p stored in %p)",

                oldest - &mBuffers[kPortIndexOutput][0],

media/libstagefright/OMXClient.cpp

+7 −6
Original line number Diff line number Diff line
@@ -90,7 +90,7 @@ struct MuxOMX : public IOMX { 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer);

            buffer_id *buffer, OMX_BOOL crossProcess);



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -112,7 +112,7 @@ struct MuxOMX : public IOMX { 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer);

            buffer_id *buffer, OMX_BOOL crossProcess);



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer);
@@ -314,8 +314,9 @@ status_t MuxOMX::getGraphicBufferUsage( 


status_t MuxOMX::useBuffer(

        node_id node, OMX_U32 port_index, const sp<IMemory> &params,

        buffer_id *buffer) {

    return getOMX(node)->useBuffer(node, port_index, params, buffer);

        buffer_id *buffer, OMX_BOOL /* crossProcess */) {

    return getOMX(node)->useBuffer(

            node, port_index, params, buffer, OMX_FALSE /* crossProcess */);

}



status_t MuxOMX::useGraphicBuffer(
@@ -353,9 +354,9 @@ status_t MuxOMX::allocateBuffer( 


status_t MuxOMX::allocateBufferWithBackup(

        node_id node, OMX_U32 port_index, const sp<IMemory> &params,

        buffer_id *buffer) {

        buffer_id *buffer, OMX_BOOL /* crossProcess */) {

    return getOMX(node)->allocateBufferWithBackup(

            node, port_index, params, buffer);

            node, port_index, params, buffer, OMX_FALSE /* crossProcess */);

}



status_t MuxOMX::freeBuffer(

media/libstagefright/include/OMX.h

+2 −2
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ public: 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer);

            buffer_id *buffer, OMX_BOOL crossProcess);



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -103,7 +103,7 @@ public: 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer);

            buffer_id *buffer, OMX_BOOL crossProcess);



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer);