Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d11c43a1 authored by Ronghua Wu's avatar Ronghua Wu
Browse files

mediaresourcemanager: verify the input calling pid 

Bug: 26830615
Change-Id: I2e9c579b3bdd86a90b08fa161206d32527390bb5
parent cf1bbf3a

include/media/stagefright/ProcessInfo.h

+1 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ struct ProcessInfo : public ProcessInfoInterface { 
    ProcessInfo();



    virtual bool getPriority(int pid, int* priority);

    virtual bool isValidPid(int pid);



protected:

    virtual ~ProcessInfo();

include/media/stagefright/ProcessInfoInterface.h

+1 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ namespace android { 


struct ProcessInfoInterface : public RefBase {

    virtual bool getPriority(int pid, int* priority) = 0;

    virtual bool isValidPid(int pid) = 0;



protected:

    virtual ~ProcessInfoInterface() {}

media/libmediaplayerservice/tests/DrmSessionManager_test.cpp

+4 −0
Original line number Diff line number Diff line
@@ -39,6 +39,10 @@ struct FakeProcessInfo : public ProcessInfoInterface { 
        return true;

    }



    virtual bool isValidPid(int /* pid */) {

        return true;

    }



private:

    DISALLOW_EVIL_CONSTRUCTORS(FakeProcessInfo);

};

media/libstagefright/ProcessInfo.cpp

+7 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 


#include <media/stagefright/ProcessInfo.h>



#include <binder/IPCThreadState.h>

#include <binder/IProcessInfoService.h>

#include <binder/IServiceManager.h>
@@ -52,6 +53,12 @@ bool ProcessInfo::getPriority(int pid, int* priority) { 
    return true;

}



bool ProcessInfo::isValidPid(int pid) {

    int callingPid = IPCThreadState::self()->getCallingPid();

    // Trust it if this is called from the same process otherwise pid has to match the calling pid.

    return (callingPid == getpid()) || (callingPid == pid);

}



ProcessInfo::~ProcessInfo() {}



}  // namespace android

services/mediaresourcemanager/ResourceManagerService.cpp

+12 −0
Original line number Diff line number Diff line
@@ -206,6 +206,10 @@ void ResourceManagerService::addResource( 
    mServiceLog->add(log);



    Mutex::Autolock lock(mLock);

    if (!mProcessInfo->isValidPid(pid)) {

        ALOGE("Rejected addResource call with invalid pid.");

        return;

    }

    ResourceInfos& infos = getResourceInfosForEdit(pid, mMap);

    ResourceInfo& info = getResourceInfoForEdit(clientId, client, infos);

    // TODO: do the merge instead of append.
@@ -220,6 +224,10 @@ void ResourceManagerService::removeResource(int pid, int64_t clientId) { 
    mServiceLog->add(log);



    Mutex::Autolock lock(mLock);

    if (!mProcessInfo->isValidPid(pid)) {

        ALOGE("Rejected removeResource call with invalid pid.");

        return;

    }

    ssize_t index = mMap.indexOfKey(pid);

    if (index < 0) {

        ALOGV("removeResource: didn't find pid %d for clientId %lld", pid, (long long) clientId);
@@ -259,6 +267,10 @@ bool ResourceManagerService::reclaimResource( 
    Vector<sp<IResourceManagerClient>> clients;

    {

        Mutex::Autolock lock(mLock);

        if (!mProcessInfo->isValidPid(callingPid)) {

            ALOGE("Rejected reclaimResource call with invalid callingPid.");

            return false;

        }

        const MediaResource *secureCodec = NULL;

        const MediaResource *nonSecureCodec = NULL;

        const MediaResource *graphicMemory = NULL;