Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75a77e7d authored by Yuncheol Heo's avatar Yuncheol Heo
Browse files

Add HdmiCecMessageValidator to verify the incoming messages. 

- Remove all param's length-check-logics in the package.

Bug: 16051295, Bug: 16117332, Bug: 15841545
Change-Id: If48ad9731f4f4613fd22aa3d9ada7ba3142bc999
parent 770a6caf

core/java/android/hardware/hdmi/HdmiCecDeviceInfo.java

+6 −0
Original line number Diff line number Diff line
@@ -48,6 +48,12 @@ public final class HdmiCecDeviceInfo implements Parcelable { 
    /** Audio system device type. */

    public static final int DEVICE_AUDIO_SYSTEM = 5;



    /** @hide Pure CEC switch device type. */

    public static final int DEVICE_PURE_CEC_SWITCH = 6;



    /** @hide Video processor device type. */

    public static final int DEVICE_VIDEO_PROCESSOR = 7;



    // Value indicating the device is not an active source.

    public static final int DEVICE_INACTIVE = -1;

services/core/java/com/android/server/hdmi/Constants.java

+4 −0
Original line number Diff line number Diff line
@@ -141,12 +141,15 @@ final class Constants { 
    static final int MESSAGE_VENDOR_COMMAND_WITH_ID = 0xA0;

    static final int MESSAGE_CLEAR_EXTERNAL_TIMER = 0xA1;

    static final int MESSAGE_SET_EXTERNAL_TIMER = 0xA2;

    static final int MESSAGE_REPORT_SHORT_AUDIO_DESCRIPTOR = 0xA3;

    static final int MESSAGE_REQUEST_SHORT_AUDIO_DESCRIPTOR = 0xA4;

    static final int MESSAGE_INITIATE_ARC = 0xC0;

    static final int MESSAGE_REPORT_ARC_INITIATED = 0xC1;

    static final int MESSAGE_REPORT_ARC_TERMINATED = 0xC2;

    static final int MESSAGE_REQUEST_ARC_INITIATION = 0xC3;

    static final int MESSAGE_REQUEST_ARC_TERMINATION = 0xC4;

    static final int MESSAGE_TERMINATE_ARC = 0xC5;

    static final int MESSAGE_CDC_MESSAGE = 0xF8;

    static final int MESSAGE_ABORT = 0xFF;



    static final int UNKNOWN_VENDOR_ID = 0xFFFFFF;
@@ -168,6 +171,7 @@ final class Constants { 
    // Bit mask used to get the routing path of the top level device.

    // When &'d with the path 1.2.2.0 (0x1220), for instance, gives 1.0.0.0.

    static final int ROUTING_PATH_TOP_MASK = 0xF000;

    static final int ROUTING_PATH_TOP_SHIFT = 12;



    static final int INVALID_PORT_ID = -1;

    static final int INVALID_PHYSICAL_ADDRESS = 0xFFFF;

services/core/java/com/android/server/hdmi/DeviceDiscoveryAction.java

+6 −17
Original line number Diff line number Diff line
@@ -253,18 +253,11 @@ final class DeviceDiscoveryAction extends FeatureAction { 
        }



        byte params[] = cmd.getParams();

        if (params.length == 3) {

        current.mPhysicalAddress = HdmiUtils.twoBytesToInt(params);

        current.mDeviceType = params[2] & 0xFF;



        increaseProcessedDeviceCount();

        checkAndProceedStage();

        } else {

            // Physical address is a critical element in device info.

            // If failed, remove device from device list and proceed to the next device.

            removeDevice(mProcessedDeviceCount);

            checkAndProceedStage();

        }

    }



    private void handleSetOsdName(HdmiCecMessage cmd) {
@@ -301,12 +294,8 @@ final class DeviceDiscoveryAction extends FeatureAction { 
        }



        byte[] params = cmd.getParams();

        if (params.length == 3) {

        int vendorId = HdmiUtils.threeBytesToInt(params);

        current.mVendorId = vendorId;

        } else {

            Slog.w(TAG, "Invalid vendor id: " + cmd.toString());

        }

        increaseProcessedDeviceCount();

        checkAndProceedStage();

    }

services/core/java/com/android/server/hdmi/DeviceSelectAction.java

+2 −2
Original line number Diff line number Diff line
@@ -124,12 +124,12 @@ final class DeviceSelectAction extends FeatureAction { 


        switch (mState) {

            case STATE_WAIT_FOR_REPORT_POWER_STATUS:

                if (opcode == Constants.MESSAGE_REPORT_POWER_STATUS && params.length == 1) {

                if (opcode == Constants.MESSAGE_REPORT_POWER_STATUS) {

                    return handleReportPowerStatus(params[0]);

                }

                return false;

            case STATE_WAIT_FOR_ACTIVE_SOURCE:

                if (opcode == Constants.MESSAGE_ACTIVE_SOURCE && params.length == 2) {

                if (opcode == Constants.MESSAGE_ACTIVE_SOURCE) {

                    int activePath = HdmiUtils.twoBytesToInt(params);

                    ActiveSourceHandler

                            .create((HdmiCecLocalDeviceTv) localDevice(), mCallback)

services/core/java/com/android/server/hdmi/HdmiCecLocalDevice.java

+0 −2
Original line number Diff line number Diff line
@@ -306,7 +306,6 @@ abstract class HdmiCecLocalDevice { 
    private static boolean isPowerOnOrToggleCommand(HdmiCecMessage message) {

        byte[] params = message.getParams();

        return message.getOpcode() == Constants.MESSAGE_USER_CONTROL_PRESSED

                && params.length == 1

                && (params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER

                        || params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER_ON_FUNCTION

                        || params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER_TOGGLE_FUNCTION);
@@ -315,7 +314,6 @@ abstract class HdmiCecLocalDevice { 
    private static boolean isPowerOffOrToggleCommand(HdmiCecMessage message) {

        byte[] params = message.getParams();

        return message.getOpcode() == Constants.MESSAGE_USER_CONTROL_PRESSED

                && params.length == 1

                && (params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER

                        || params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER_OFF_FUNCTION

                        || params[0] == HdmiCecKeycode.CEC_KEYCODE_POWER_TOGGLE_FUNCTION);