DO NOT MERGE: IOMX: work against metadata buffer spoofing (ee9effab) · Commits · e / os / android_frameworks_av

include/media/IOMX.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -95,7 +95,7 @@ public:

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) = 0;
		buffer_id *buffer, OMX_BOOL crossProcess = OMX_FALSE) = 0;

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -121,7 +121,7 @@ public:

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) = 0;
		buffer_id *buffer, OMX_BOOL crossProcess = OMX_FALSE) = 0;

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer) = 0;

media/libmedia/IOMX.cpp

+9 −5

Original line number	Diff line number	Diff line
		@@ -244,7 +244,7 @@ public:

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) {
		buffer_id buffer, OMX_BOOL / crossProcess */) {
		Parcel data, reply;
		data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
		data.writeIntPtr((intptr_t)node);
		@@ -395,7 +395,7 @@ public:

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) {
		buffer_id buffer, OMX_BOOL / crossProcess */) {
		Parcel data, reply;
		data.writeInterfaceToken(IOMX::getInterfaceDescriptor());
		data.writeIntPtr((intptr_t)node);
		@@ -737,7 +737,8 @@ status_t BnOMX::onTransact(
		interface_cast<IMemory>(data.readStrongBinder());

		buffer_id buffer;
		status_t err = useBuffer(node, port_index, params, &buffer);
		status_t err = useBuffer(
		node, port_index, params, &buffer, OMX_TRUE /* crossProcess */);
		reply->writeInt32(err);

		if (err == OK) {
		@@ -825,7 +826,10 @@ status_t BnOMX::onTransact(
		OMX_U32 port_index = data.readInt32();
		OMX_BOOL enable = (OMX_BOOL)data.readInt32();

		status_t err = storeMetaDataInBuffers(node, port_index, enable);
		status_t err =
		// only control output metadata via Binder
		port_index != 1 /* kOutputPortIndex */ ? BAD_VALUE :
		storeMetaDataInBuffers(node, port_index, enable);
		reply->writeInt32(err);

		return NO_ERROR;
		@@ -887,7 +891,7 @@ status_t BnOMX::onTransact(

		buffer_id buffer;
		status_t err = allocateBufferWithBackup(
		node, port_index, params, &buffer);
		node, port_index, params, &buffer, OMX_TRUE /* crossProcess */);

		reply->writeInt32(err);

media/libstagefright/ACodec.cpp

+2 −1

Original line number	Diff line number	Diff line
		@@ -866,7 +866,8 @@ ACodec::BufferInfo *ACodec::dequeueBufferFromNativeWindow() {
		VideoDecoderOutputMetaData *metaData =
		reinterpret_cast<VideoDecoderOutputMetaData *>(
		oldest->mData->base());
		CHECK_EQ(metaData->eType, kMetadataBufferTypeGrallocSource);
		// metaData is only readable if codec is in the same process
		//CHECK_EQ(metaData->eType, kMetadataBufferTypeGrallocSource);

		ALOGV("replaced oldest buffer #%u with age %u (%p/%p stored in %p)",
		oldest - &mBuffers[kPortIndexOutput][0],

media/libstagefright/OMXClient.cpp

+7 −6

Original line number	Diff line number	Diff line
		@@ -81,7 +81,7 @@ struct MuxOMX : public IOMX {

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer);
		buffer_id *buffer, OMX_BOOL crossProcess);

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -103,7 +103,7 @@ struct MuxOMX : public IOMX {

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer);
		buffer_id *buffer, OMX_BOOL crossProcess);

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer);
		@@ -291,8 +291,9 @@ status_t MuxOMX::getGraphicBufferUsage(

		status_t MuxOMX::useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) {
		return getOMX(node)->useBuffer(node, port_index, params, buffer);
		buffer_id buffer, OMX_BOOL / crossProcess */) {
		return getOMX(node)->useBuffer(
		node, port_index, params, buffer, OMX_FALSE /* crossProcess */);
		}

		status_t MuxOMX::useGraphicBuffer(
		@@ -330,9 +331,9 @@ status_t MuxOMX::allocateBuffer(

		status_t MuxOMX::allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer) {
		buffer_id buffer, OMX_BOOL / crossProcess */) {
		return getOMX(node)->allocateBufferWithBackup(
		node, port_index, params, buffer);
		node, port_index, params, buffer, OMX_FALSE /* crossProcess */);
		}

		status_t MuxOMX::freeBuffer(

media/libstagefright/include/OMX.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -77,7 +77,7 @@ public:

		virtual status_t useBuffer(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer);
		buffer_id *buffer, OMX_BOOL crossProcess);

		virtual status_t useGraphicBuffer(
		node_id node, OMX_U32 port_index,
		@@ -99,7 +99,7 @@ public:

		virtual status_t allocateBufferWithBackup(
		node_id node, OMX_U32 port_index, const sp<IMemory> &params,
		buffer_id *buffer);
		buffer_id *buffer, OMX_BOOL crossProcess);

		virtual status_t freeBuffer(
		node_id node, OMX_U32 port_index, buffer_id buffer);