Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd4fee4c authored by android-build-team Robot's avatar android-build-team Robot
Browse files

Snap for 4725392 from 554e08c6 to pi-release 

Change-Id: I05502121a55530663b0c49ff3b43aa1fdc01c234
parents 8d0ab52a 554e08c6

camera/ndk/include/camera/NdkCameraMetadataTags.h

+1 −1
Original line number Diff line number Diff line
@@ -7100,7 +7100,7 @@ typedef enum acamera_metadata_enum_acamera_request_available_capabilities { 


    /**

     * <p>The camera device is a monochrome camera that doesn't contain a color filter array,

     * and the pixel values on U and Y planes are all 128.</p>

     * and the pixel values on U and V planes are all 128.</p>

     */

    ACAMERA_REQUEST_AVAILABLE_CAPABILITIES_MONOCHROME                = 12,

include/media/MmapStreamCallback.h

+1 −2
Original line number Diff line number Diff line
@@ -31,9 +31,8 @@ class MmapStreamCallback : public virtual RefBase { 
     * The mmap stream should be torn down because conditions that permitted its creation with

     * the requested parameters have changed and do not allow it to operate with the requested

     * constraints any more.

     * \param[in] handle handle for the client stream to tear down.

     */

    virtual void onTearDown(audio_port_handle_t handle) = 0;

    virtual void onTearDown() = 0;



    /**

     * The volume to be applied to the use case specified when opening the stream has changed

media/libaudioclient/IAudioPolicyService.cpp

+53 −14
Original line number Diff line number Diff line
@@ -872,7 +872,9 @@ status_t BnAudioPolicyService::onTransact( 
        case INIT_STREAM_VOLUME:

        case SET_STREAM_VOLUME:

        case REGISTER_POLICY_MIXES:

        case SET_MASTER_MONO: {

        case SET_MASTER_MONO:

        case START_AUDIO_SOURCE:

        case STOP_AUDIO_SOURCE: {

            uid_t multiUserClientUid = IPCThreadState::self()->getCallingUid() % AID_USER_OFFSET;

            if (multiUserClientUid >= AID_APP_START) {

                ALOGW("%s: transaction %d received from PID %d unauthorized UID %d",
@@ -989,7 +991,7 @@ status_t BnAudioPolicyService::onTransact( 


        case GET_OUTPUT_FOR_ATTR: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            audio_attributes_t attr;

            audio_attributes_t attr = {};

            bool hasAttributes = data.readInt32() != 0;

            if (hasAttributes) {

                data.read(&attr, sizeof(audio_attributes_t));
@@ -1058,7 +1060,7 @@ status_t BnAudioPolicyService::onTransact( 


        case GET_INPUT_FOR_ATTR: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            audio_attributes_t attr;

            audio_attributes_t attr = {};

            data.read(&attr, sizeof(audio_attributes_t));

            sanetizeAudioAttributes(&attr);

            audio_io_handle_t input = (audio_io_handle_t)data.readInt32();
@@ -1160,8 +1162,11 @@ status_t BnAudioPolicyService::onTransact( 


        case GET_OUTPUT_FOR_EFFECT: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            effect_descriptor_t desc;

            data.read(&desc, sizeof(effect_descriptor_t));

            effect_descriptor_t desc = {};

            if (data.read(&desc, sizeof(desc)) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "73126106");

            }

            (void)sanitizeEffectDescriptor(&desc);

            audio_io_handle_t output = getOutputForEffect(&desc);

            reply->writeInt32(static_cast <int>(output));

            return NO_ERROR;
@@ -1169,8 +1174,11 @@ status_t BnAudioPolicyService::onTransact( 


        case REGISTER_EFFECT: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            effect_descriptor_t desc;

            data.read(&desc, sizeof(effect_descriptor_t));

            effect_descriptor_t desc = {};

            if (data.read(&desc, sizeof(desc)) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "73126106");

            }

            (void)sanitizeEffectDescriptor(&desc);

            audio_io_handle_t io = data.readInt32();

            uint32_t strategy = data.readInt32();

            audio_session_t session = (audio_session_t) data.readInt32();
@@ -1229,7 +1237,7 @@ status_t BnAudioPolicyService::onTransact( 
                count = AudioEffect::kMaxPreProcessing;

            }

            uint32_t retCount = count;

            effect_descriptor_t *descriptors = new effect_descriptor_t[count];

            effect_descriptor_t *descriptors = new effect_descriptor_t[count]{};

            status_t status = queryDefaultPreProcessing(audioSession, descriptors, &retCount);

            reply->writeInt32(status);

            if (status != NO_ERROR && status != NO_MEMORY) {
@@ -1248,7 +1256,7 @@ status_t BnAudioPolicyService::onTransact( 


        case IS_OFFLOAD_SUPPORTED: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            audio_offload_info_t info;

            audio_offload_info_t info = {};

            data.read(&info, sizeof(audio_offload_info_t));

            bool isSupported = isOffloadSupported(info);

            reply->writeInt32(isSupported);
@@ -1303,7 +1311,7 @@ status_t BnAudioPolicyService::onTransact( 


        case CREATE_AUDIO_PATCH: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            struct audio_patch patch;

            struct audio_patch patch = {};

            data.read(&patch, sizeof(struct audio_patch));

            audio_patch_handle_t handle = AUDIO_PATCH_HANDLE_NONE;

            if (data.read(&handle, sizeof(audio_patch_handle_t)) != NO_ERROR) {
@@ -1319,7 +1327,7 @@ status_t BnAudioPolicyService::onTransact( 


        case RELEASE_AUDIO_PATCH: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            audio_patch_handle_t handle;

            audio_patch_handle_t handle = AUDIO_PATCH_HANDLE_NONE;

            data.read(&handle, sizeof(audio_patch_handle_t));

            status_t status = releaseAudioPatch(handle);

            reply->writeInt32(status);
@@ -1358,8 +1366,9 @@ status_t BnAudioPolicyService::onTransact( 


        case SET_AUDIO_PORT_CONFIG: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            struct audio_port_config config;

            struct audio_port_config config = {};

            data.read(&config, sizeof(struct audio_port_config));

            (void)sanitizeAudioPortConfig(&config);

            status_t status = setAudioPortConfig(&config);

            reply->writeInt32(status);

            return NO_ERROR;
@@ -1433,9 +1442,10 @@ status_t BnAudioPolicyService::onTransact( 


        case START_AUDIO_SOURCE: {

            CHECK_INTERFACE(IAudioPolicyService, data, reply);

            struct audio_port_config source;

            struct audio_port_config source = {};

            data.read(&source, sizeof(struct audio_port_config));

            audio_attributes_t attributes;

            (void)sanitizeAudioPortConfig(&source);

            audio_attributes_t attributes = {};

            data.read(&attributes, sizeof(audio_attributes_t));

            sanetizeAudioAttributes(&attributes);

            audio_patch_handle_t handle = AUDIO_PATCH_HANDLE_NONE;
@@ -1488,6 +1498,14 @@ status_t BnAudioPolicyService::onTransact( 
    }

}



/** returns true if string overflow was prevented by zero termination */

template <size_t size>

static bool preventStringOverflow(char (&s)[size]) {

    if (strnlen(s, size) < size) return false;

    s[size - 1] = '\0';

    return true;

}



void BnAudioPolicyService::sanetizeAudioAttributes(audio_attributes_t* attr)

{

    const size_t tagsMaxSize = AUDIO_ATTRIBUTES_TAGS_MAX_SIZE;
@@ -1497,6 +1515,27 @@ void BnAudioPolicyService::sanetizeAudioAttributes(audio_attributes_t* attr) 
    attr->tags[tagsMaxSize - 1] = '\0';

}



/** returns BAD_VALUE if sanitization was required. */

status_t BnAudioPolicyService::sanitizeEffectDescriptor(effect_descriptor_t* desc)

{

    if (preventStringOverflow(desc->name)

        | /* always */ preventStringOverflow(desc->implementor)) {

        android_errorWriteLog(0x534e4554, "73126106"); // SafetyNet logging

        return BAD_VALUE;

    }

    return NO_ERROR;

}



/** returns BAD_VALUE if sanitization was required. */

status_t BnAudioPolicyService::sanitizeAudioPortConfig(struct audio_port_config* config)

{

    if (config->type == AUDIO_PORT_TYPE_DEVICE &&

        preventStringOverflow(config->ext.device.address)) {

        return BAD_VALUE;

    }

    return NO_ERROR;

}



// ----------------------------------------------------------------------------



} // namespace android

media/libaudioclient/include/media/IAudioPolicyService.h

+2 −0
Original line number Diff line number Diff line
@@ -180,6 +180,8 @@ public: 
                                    uint32_t flags = 0);

private:

    void sanetizeAudioAttributes(audio_attributes_t* attr);

    status_t sanitizeEffectDescriptor(effect_descriptor_t* desc);

    status_t sanitizeAudioPortConfig(struct audio_port_config* config);

};



// ----------------------------------------------------------------------------

services/audioflinger/AudioFlinger.cpp

+6 −4
Original line number Diff line number Diff line
@@ -1000,12 +1000,14 @@ void AudioFlinger::setRecordSilenced(uid_t uid, bool silenced) 
{

    ALOGV("AudioFlinger::setRecordSilenced(uid:%d, silenced:%d)", uid, silenced);



    // TODO: Notify MmapThreads



    AutoMutex lock(mLock);

    for (size_t i = 0; i < mRecordThreads.size(); i++) {

        mRecordThreads[i]->setRecordSilenced(uid, silenced);

        sp<RecordThread> thread = mRecordThreads.valueAt(i);

        if (thread != 0) {

            thread->setRecordSilenced(uid, silenced);

        }

    for (size_t i = 0; i < mMmapThreads.size(); i++) {

        mMmapThreads[i]->setRecordSilenced(uid, silenced);

    }

}