Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8a4cb41 authored by Lajos Molnar's avatar Lajos Molnar
Browse files

IOMX: work against metadata buffer spoofing 

- Prohibit direct set/getParam/Settings for extensions meant for
  OMXNodeInstance alone. This disallows enabling metadata mode
  without the knowledge of OMXNodeInstance.
- Do not share metadata mode buffers cross process.
- Disallow setting up metadata mode/tunneling/input surface
  after first sendCommand.
- Disallow store-meta for input cross process.
- Disallow emptyBuffer for surface input (via IOMX).
- Fix checking for input surface.

Bug: 29422020
Change-Id: I801c77b80e703903f62e42d76fd2e76a34e4bc8e
parent 7ab70a7b

include/media/IOMX.h

+2 −2
Original line number Diff line number Diff line
@@ -107,7 +107,7 @@ public: 
    // Use |params| as an OMX buffer, but limit the size of the OMX buffer to |allottedSize|.

    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize) = 0;

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess = OMX_FALSE) = 0;



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -149,7 +149,7 @@ public: 
    // may be larger.

    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize) = 0;

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess = OMX_FALSE) = 0;



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer) = 0;

media/libmedia/IOMX.cpp

+9 −5
Original line number Diff line number Diff line
@@ -248,7 +248,7 @@ public: 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize) {

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL /* crossProcess */) {

        Parcel data, reply;

        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());

        data.writeInt32((int32_t)node);
@@ -481,7 +481,7 @@ public: 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize) {

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL /* crossProcess */) {

        Parcel data, reply;

        data.writeInterfaceToken(IOMX::getInterfaceDescriptor());

        data.writeInt32((int32_t)node);
@@ -834,7 +834,8 @@ status_t BnOMX::onTransact( 
            OMX_U32 allottedSize = data.readInt32();



            buffer_id buffer;

            status_t err = useBuffer(node, port_index, params, &buffer, allottedSize);

            status_t err = useBuffer(

                    node, port_index, params, &buffer, allottedSize, OMX_TRUE /* crossProcess */);

            reply->writeInt32(err);



            if (err == OK) {
@@ -969,7 +970,10 @@ status_t BnOMX::onTransact( 
            OMX_BOOL enable = (OMX_BOOL)data.readInt32();



            MetadataBufferType type = kMetadataBufferTypeInvalid;

            status_t err = storeMetaDataInBuffers(node, port_index, enable, &type);

            status_t err =

                // only control output metadata via Binder

                port_index != 1 /* kOutputPortIndex */ ? BAD_VALUE :

                storeMetaDataInBuffers(node, port_index, enable, &type);



            reply->writeInt32(type);

            reply->writeInt32(err);
@@ -1054,7 +1058,7 @@ status_t BnOMX::onTransact( 


            buffer_id buffer;

            status_t err = allocateBufferWithBackup(

                    node, port_index, params, &buffer, allottedSize);

                    node, port_index, params, &buffer, allottedSize, OMX_TRUE /* crossProcess */);



            reply->writeInt32(err);

media/libstagefright/OMXClient.cpp

+7 −6
Original line number Diff line number Diff line
@@ -90,7 +90,7 @@ struct MuxOMX : public IOMX { 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize);

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -120,7 +120,7 @@ struct MuxOMX : public IOMX { 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize);

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer);
@@ -322,8 +322,9 @@ status_t MuxOMX::getGraphicBufferUsage( 


status_t MuxOMX::useBuffer(

        node_id node, OMX_U32 port_index, const sp<IMemory> &params,

        buffer_id *buffer, OMX_U32 allottedSize) {

    return getOMX(node)->useBuffer(node, port_index, params, buffer, allottedSize);

        buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL /* crossProcess */) {

    return getOMX(node)->useBuffer(

            node, port_index, params, buffer, allottedSize, OMX_FALSE /* crossProcess */);

}



status_t MuxOMX::useGraphicBuffer(
@@ -375,9 +376,9 @@ status_t MuxOMX::allocateBuffer( 


status_t MuxOMX::allocateBufferWithBackup(

        node_id node, OMX_U32 port_index, const sp<IMemory> &params,

        buffer_id *buffer, OMX_U32 allottedSize) {

        buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL /* crossProcess */) {

    return getOMX(node)->allocateBufferWithBackup(

            node, port_index, params, buffer, allottedSize);

            node, port_index, params, buffer, allottedSize, OMX_FALSE /* crossProcess */);

}



status_t MuxOMX::freeBuffer(

media/libstagefright/include/OMX.h

+2 −2
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ public: 


    virtual status_t useBuffer(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize);

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    virtual status_t useGraphicBuffer(

            node_id node, OMX_U32 port_index,
@@ -113,7 +113,7 @@ public: 


    virtual status_t allocateBufferWithBackup(

            node_id node, OMX_U32 port_index, const sp<IMemory> &params,

            buffer_id *buffer, OMX_U32 allottedSize);

            buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    virtual status_t freeBuffer(

            node_id node, OMX_U32 port_index, buffer_id buffer);

media/libstagefright/include/OMXNodeInstance.h

+8 −2
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include "OMX.h"



#include <utils/RefBase.h>

#include <utils/SortedVector.h>

#include <utils/threads.h>



namespace android {
@@ -71,7 +72,7 @@ struct OMXNodeInstance { 


    status_t useBuffer(

            OMX_U32 portIndex, const sp<IMemory> &params,

            OMX::buffer_id *buffer, OMX_U32 allottedSize);

            OMX::buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    status_t useGraphicBuffer(

            OMX_U32 portIndex, const sp<GraphicBuffer> &graphicBuffer,
@@ -101,7 +102,7 @@ struct OMXNodeInstance { 


    status_t allocateBufferWithBackup(

            OMX_U32 portIndex, const sp<IMemory> &params,

            OMX::buffer_id *buffer, OMX_U32 allottedSize);

            OMX::buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess);



    status_t freeBuffer(OMX_U32 portIndex, OMX::buffer_id buffer);
@@ -146,6 +147,9 @@ private: 
    OMX_HANDLETYPE mHandle;

    sp<IOMXObserver> mObserver;

    bool mDying;

    bool mSailed;  // configuration is set (no more meta-mode changes)

    bool mQueriedProhibitedExtensions;

    SortedVector<OMX_INDEXTYPE> mProhibitedExtensions;

    bool mIsSecure;



    // Lock only covers mGraphicBufferSource.  We can't always use mLock
@@ -191,6 +195,8 @@ private: 
    OMX::buffer_id findBufferID(OMX_BUFFERHEADERTYPE *bufferHeader);

    void invalidateBufferID(OMX::buffer_id buffer);



    bool isProhibitedIndex_l(OMX_INDEXTYPE index);



    status_t useGraphicBuffer2_l(

            OMX_U32 portIndex, const sp<GraphicBuffer> &graphicBuffer,

            OMX::buffer_id *buffer);