Snap for 6337011 from ae2c605380345aa2b08b9f78f16161a5cb9d6f7c to qt-qpr3-release (f39f936e) · Commits · e / os / android_frameworks_av

media/codec2/sfplugin/CCodecBuffers.cpp

+4 −3

Original line number	Diff line number	Diff line
		@@ -878,9 +878,10 @@ void OutputBuffersArray::realloc(const std::shared_ptr<C2Buffer> &c2buffer) {
		switch (c2buffer->data().type()) {
		case C2BufferData::LINEAR: {
		uint32_t size = kLinearBufferSize;
		const C2ConstLinearBlock &block = c2buffer->data().linearBlocks().front();
		if (block.size() < kMaxLinearBufferSize / 2) {
		size = block.size() * 2;
		const std::vector<C2ConstLinearBlock> &linear_blocks = c2buffer->data().linearBlocks();
		const uint32_t block_size = linear_blocks.front().size();
		if (block_size < kMaxLinearBufferSize / 2) {
		size = block_size * 2;
		} else {
		size = kMaxLinearBufferSize;
		}

media/extractors/mp4/MPEG4Extractor.cpp

+37 −3

Original line number	Diff line number	Diff line
		@@ -4993,8 +4993,11 @@ status_t MPEG4Source::parseChunk(off64_t *offset) {
		}

		status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		off64_t offset, off64_t /* size */) {
		off64_t offset, off64_t size) {
		ALOGV("parseSampleAuxiliaryInformationSizes");
		if (size < 9) {
		return -EINVAL;
		}
		// 14496-12 8.7.12
		uint8_t version;
		if (mDataSource->readAt(
		@@ -5007,25 +5010,32 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		return ERROR_UNSUPPORTED;
		}
		offset++;
		size--;

		uint32_t flags;
		if (!mDataSource->getUInt24(offset, &flags)) {
		return ERROR_IO;
		}
		offset += 3;
		size -= 3;

		if (flags & 1) {
		if (size < 13) {
		return -EINVAL;
		}
		uint32_t tmp;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_MALFORMED;
		}
		mCurrentAuxInfoType = tmp;
		offset += 4;
		size -= 4;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_MALFORMED;
		}
		mCurrentAuxInfoTypeParameter = tmp;
		offset += 4;
		size -= 4;
		}

		uint8_t defsize;
		@@ -5034,6 +5044,7 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}
		mCurrentDefaultSampleInfoSize = defsize;
		offset++;
		size--;

		uint32_t smplcnt;
		if (!mDataSource->getUInt32(offset, &smplcnt)) {
		@@ -5041,11 +5052,16 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}
		mCurrentSampleInfoCount = smplcnt;
		offset += 4;

		size -= 4;
		if (mCurrentDefaultSampleInfoSize != 0) {
		ALOGV("@@@@ using default sample info size of %d", mCurrentDefaultSampleInfoSize);
		return OK;
		}
		if(smplcnt > size) {
		ALOGW("b/124525515 - smplcnt(%u) > size(%ld)", (unsigned int)smplcnt, (unsigned long)size);
		android_errorWriteLog(0x534e4554, "124525515");
		return -EINVAL;
		}
		if (smplcnt > mCurrentSampleInfoAllocSize) {
		uint8_t * newPtr = (uint8_t*) realloc(mCurrentSampleInfoSizes, smplcnt);
		if (newPtr == NULL) {
		@@ -5061,26 +5077,32 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationSizes(
		}

		status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(
		off64_t offset, off64_t /* size */) {
		off64_t offset, off64_t size) {
		ALOGV("parseSampleAuxiliaryInformationOffsets");
		if (size < 8) {
		return -EINVAL;
		}
		// 14496-12 8.7.13
		uint8_t version;
		if (mDataSource->readAt(offset, &version, sizeof(version)) != 1) {
		return ERROR_IO;
		}
		offset++;
		size--;

		uint32_t flags;
		if (!mDataSource->getUInt24(offset, &flags)) {
		return ERROR_IO;
		}
		offset += 3;
		size -= 3;

		uint32_t entrycount;
		if (!mDataSource->getUInt32(offset, &entrycount)) {
		return ERROR_IO;
		}
		offset += 4;
		size -= 4;
		if (entrycount == 0) {
		return OK;
		}
		@@ -5106,19 +5128,31 @@ status_t MPEG4Source::parseSampleAuxiliaryInformationOffsets(

		for (size_t i = 0; i < entrycount; i++) {
		if (version == 0) {
		if (size < 4) {
		ALOGW("b/124526959");
		android_errorWriteLog(0x534e4554, "124526959");
		return -EINVAL;
		}
		uint32_t tmp;
		if (!mDataSource->getUInt32(offset, &tmp)) {
		return ERROR_IO;
		}
		mCurrentSampleInfoOffsets[i] = tmp;
		offset += 4;
		size -= 4;
		} else {
		if (size < 8) {
		ALOGW("b/124526959");
		android_errorWriteLog(0x534e4554, "124526959");
		return -EINVAL;
		}
		uint64_t tmp;
		if (!mDataSource->getUInt64(offset, &tmp)) {
		return ERROR_IO;
		}
		mCurrentSampleInfoOffsets[i] = tmp;
		offset += 8;
		size -= 8;
		}
		}

media/extractors/mp4/SampleTable.cpp

+7 −10

Original line number	Diff line number	Diff line
		@@ -391,20 +391,11 @@ status_t SampleTable::setTimeToSampleParams(
		}

		mTimeToSampleCount = U32_AT(&header[4]);
		if (mTimeToSampleCount > UINT32_MAX / (2 * sizeof(uint32_t))) {
		// Choose this bound because
		// 1) 2 * sizeof(uint32_t) is the amount of memory needed for one
		// time-to-sample entry in the time-to-sample table.
		// 2) mTimeToSampleCount is the number of entries of the time-to-sample
		// table.
		// 3) We hope that the table size does not exceed UINT32_MAX.
		if (mTimeToSampleCount > (data_size - 8) / (2 * sizeof(uint32_t))) {
		ALOGE("Time-to-sample table size too large.");
		return ERROR_OUT_OF_RANGE;
		}

		// Note: At this point, we know that mTimeToSampleCount * 2 will not
		// overflow because of the above condition.

		uint64_t allocSize = (uint64_t)mTimeToSampleCount * 2 * sizeof(uint32_t);
		mTotalSize += allocSize;
		if (mTotalSize > kMaxTotalSize) {
		@@ -540,6 +531,12 @@ status_t SampleTable::setSyncSampleParams(off64_t data_offset, size_t data_size)
		}

		uint64_t allocSize = (uint64_t)numSyncSamples * sizeof(uint32_t);
		if (allocSize > data_size - 8) {
		ALOGW("b/124771364 - allocSize(%lu) > size(%lu)",
		(unsigned long)allocSize, (unsigned long)(data_size - 8));
		android_errorWriteLog(0x534e4554, "124771364");
		return ERROR_MALFORMED;
		}
		if (allocSize > kMaxTotalSize) {
		ALOGE("Sync sample table size too large.");
		return ERROR_OUT_OF_RANGE;

media/libaudioclient/AudioRecord.cpp

+8 −2

Original line number	Diff line number	Diff line
		@@ -884,7 +884,6 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		{
		// previous and new IAudioRecord sequence numbers are used to detect track re-creation
		uint32_t oldSequence = 0;
		uint32_t newSequence;

		Proxy::Buffer buffer;
		status_t status = NO_ERROR;
		@@ -902,7 +901,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		// start of lock scope
		AutoMutex lock(mLock);

		newSequence = mSequence;
		uint32_t newSequence = mSequence;
		// did previous obtainBuffer() fail due to media server death or voluntary invalidation?
		if (status == DEAD_OBJECT) {
		// re-create track, unless someone else has already done so
		@@ -939,6 +938,7 @@ status_t AudioRecord::obtainBuffer(Buffer* audioBuffer, const struct timespec *r
		audioBuffer->frameCount = buffer.mFrameCount;
		audioBuffer->size = buffer.mFrameCount * mFrameSize;
		audioBuffer->raw = buffer.mRaw;
		audioBuffer->sequence = oldSequence;
		if (nonContig != NULL) {
		*nonContig = buffer.mNonContig;
		}
		@@ -959,6 +959,12 @@ void AudioRecord::releaseBuffer(const Buffer* audioBuffer)
		buffer.mRaw = audioBuffer->raw;

		AutoMutex lock(mLock);
		if (audioBuffer->sequence != mSequence) {
		// This Buffer came from a different IAudioRecord instance, so ignore the releaseBuffer
		ALOGD("%s is no-op due to IAudioRecord sequence mismatch %u != %u",
		__func__, audioBuffer->sequence, mSequence);
		return;
		}
		mInOverrun = false;
		mProxy->releaseBuffer(&buffer);

media/libaudioclient/AudioTrack.cpp

+8 −2

Original line number	Diff line number	Diff line
		@@ -1665,7 +1665,6 @@ status_t AudioTrack::obtainBuffer(Buffer* audioBuffer, const struct timespec *re
		{
		// previous and new IAudioTrack sequence numbers are used to detect track re-creation
		uint32_t oldSequence = 0;
		uint32_t newSequence;

		Proxy::Buffer buffer;
		status_t status = NO_ERROR;
		@@ -1682,7 +1681,7 @@ status_t AudioTrack::obtainBuffer(Buffer* audioBuffer, const struct timespec *re
		{ // start of lock scope
		AutoMutex lock(mLock);

		newSequence = mSequence;
		uint32_t newSequence = mSequence;
		// did previous obtainBuffer() fail due to media server death or voluntary invalidation?
		if (status == DEAD_OBJECT) {
		// re-create track, unless someone else has already done so
		@@ -1729,6 +1728,7 @@ status_t AudioTrack::obtainBuffer(Buffer* audioBuffer, const struct timespec *re
		audioBuffer->frameCount = buffer.mFrameCount;
		audioBuffer->size = buffer.mFrameCount * mFrameSize;
		audioBuffer->raw = buffer.mRaw;
		audioBuffer->sequence = oldSequence;
		if (nonContig != NULL) {
		*nonContig = buffer.mNonContig;
		}
		@@ -1752,6 +1752,12 @@ void AudioTrack::releaseBuffer(const Buffer* audioBuffer)
		buffer.mRaw = audioBuffer->raw;

		AutoMutex lock(mLock);
		if (audioBuffer->sequence != mSequence) {
		// This Buffer came from a different IAudioTrack instance, so ignore the releaseBuffer
		ALOGD("%s is no-op due to IAudioTrack sequence mismatch %u != %u",
		__func__, audioBuffer->sequence, mSequence);
		return;
		}
		mReleased += stepCount;
		mInUnderrun = false;
		mProxy->releaseBuffer(&buffer);