Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94763125 authored by Eino-Ville Talvala's avatar Eino-Ville Talvala Committed by android-build-merger
Browse files

Merge \\"DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid...

Merge \\"DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak\\" into mnc-dev am: f0dc08a9
am: 6a258918

Change-Id: Id1e326911bebf1d9ef732eb45faa4119cd83d541
parents 33f05028 6a258918
Loading
Loading
Loading
Loading
+5 −1
Original line number Diff line number Diff line
@@ -31,6 +31,11 @@ enum {
    RELEASE_RECORDING_FRAME,
};

uint8_t ICameraRecordingProxy::baseObject = 0;

size_t ICameraRecordingProxy::getCommonBaseAddress() {
    return (size_t)&baseObject;
}

class BpCameraRecordingProxy: public BpInterface<ICameraRecordingProxy>
{
@@ -106,4 +111,3 @@ status_t BnCameraRecordingProxy::onTransact(
// ----------------------------------------------------------------------------

}; // namespace android
+6 −0
Original line number Diff line number Diff line
@@ -83,6 +83,12 @@ public:
    virtual status_t        startRecording(const sp<ICameraRecordingProxyListener>& listener) = 0;
    virtual void            stopRecording() = 0;
    virtual void            releaseRecordingFrame(const sp<IMemory>& mem) = 0;

    // b/28466701
    static  size_t          getCommonBaseAddress();
  private:

    static  uint8_t         baseObject;
};

// ----------------------------------------------------------------------------
+3 −0
Original line number Diff line number Diff line
@@ -236,6 +236,9 @@ private:
    status_t checkFrameRate(const CameraParameters& params,
                    int32_t frameRate);

    static void adjustIncomingANWBuffer(IMemory* data);
    static void adjustOutgoingANWBuffer(IMemory* data);

    void stopCameraRecording();
    status_t reset();

+29 −0
Original line number Diff line number Diff line
@@ -27,8 +27,10 @@
#include <media/stagefright/MediaDefs.h>
#include <media/stagefright/MediaErrors.h>
#include <media/stagefright/MetaData.h>
#include <media/hardware/HardwareAPI.h>
#include <camera/Camera.h>
#include <camera/CameraParameters.h>
#include <camera/ICameraRecordingProxy.h>
#include <gui/Surface.h>
#include <utils/String8.h>
#include <cutils/properties.h>
@@ -792,6 +794,8 @@ void CameraSource::releaseQueuedFrames() {
    List<sp<IMemory> >::iterator it;
    while (!mFramesReceived.empty()) {
        it = mFramesReceived.begin();
        // b/28466701
        adjustOutgoingANWBuffer(it->get());
        releaseRecordingFrame(*it);
        mFramesReceived.erase(it);
        ++mNumFramesDropped;
@@ -812,6 +816,9 @@ void CameraSource::signalBufferReturned(MediaBuffer *buffer) {
    for (List<sp<IMemory> >::iterator it = mFramesBeingEncoded.begin();
         it != mFramesBeingEncoded.end(); ++it) {
        if ((*it)->pointer() ==  buffer->data()) {
            // b/28466701
            adjustOutgoingANWBuffer(it->get());

            releaseOneRecordingFrame((*it));
            mFramesBeingEncoded.erase(it);
            ++mNumFramesEncoded;
@@ -917,6 +924,10 @@ void CameraSource::dataCallbackTimestamp(int64_t timestampUs,
    ++mNumFramesReceived;

    CHECK(data != NULL && data->size() > 0);

    // b/28466701
    adjustIncomingANWBuffer(data.get());

    mFramesReceived.push_back(data);
    int64_t timeUs = mStartTimeUs + (timestampUs - mFirstFrameTimeUs);
    mFrameTimes.push_back(timeUs);
@@ -930,6 +941,24 @@ bool CameraSource::isMetaDataStoredInVideoBuffers() const {
    return mIsMetaDataStoredInVideoBuffers;
}

void CameraSource::adjustIncomingANWBuffer(IMemory* data) {
    VideoNativeMetadata *payload =
            reinterpret_cast<VideoNativeMetadata*>(data->pointer());
    if (payload->eType == kMetadataBufferTypeANWBuffer) {
        payload->pBuffer = (ANativeWindowBuffer*)(((uint8_t*)payload->pBuffer) +
                ICameraRecordingProxy::getCommonBaseAddress());
    }
}

void CameraSource::adjustOutgoingANWBuffer(IMemory* data) {
    VideoNativeMetadata *payload =
            reinterpret_cast<VideoNativeMetadata*>(data->pointer());
    if (payload->eType == kMetadataBufferTypeANWBuffer) {
        payload->pBuffer = (ANativeWindowBuffer*)(((uint8_t*)payload->pBuffer) -
                ICameraRecordingProxy::getCommonBaseAddress());
    }
}

CameraSource::ProxyListener::ProxyListener(const sp<CameraSource>& source) {
    mSource = source;
}
+8 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@
#include <utils/Trace.h>
#include <gui/BufferItem.h>
#include <gui/Surface.h>
#include <camera/ICameraRecordingProxy.h>
#include <media/hardware/HardwareAPI.h>

#include "common/CameraDeviceBase.h"
@@ -826,6 +827,9 @@ status_t StreamingProcessor::processRecordingFrame() {
            (uint8_t*)heap->getBase() + offset);
        payload->eType = kMetadataBufferTypeANWBuffer;
        payload->pBuffer = imgBuffer.mGraphicBuffer->getNativeBuffer();
        // b/28466701
        payload->pBuffer = (ANativeWindowBuffer*)((uint8_t*)payload->pBuffer -
                ICameraRecordingProxy::getCommonBaseAddress());
        payload->nFenceFd = -1;

        ALOGVV("%s: Camera %d: Sending out ANWBuffer %p",
@@ -874,6 +878,10 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) {
        return;
    }

    // b/28466701
    payload->pBuffer = (ANativeWindowBuffer*)(((uint8_t*)payload->pBuffer) +
            ICameraRecordingProxy::getCommonBaseAddress());

    // Release the buffer back to the recording queue
    size_t itemIndex;
    for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) {