Merge tag 'android-6.0.0_r26' into cm-13.0

Android 6.0.0 release 26

Change-Id: I8a57007bf6efcd8b95c3cebf5e0444345bdd4cda

3 files changed, 19 insertions, 5 deletions

diff --git a/media/libmedia/AudioTrack.cpp b/media/libmedia/AudioTrack.cpp
index 5af70d3..946c118 100644
--- a/media/libmedia/AudioTrack.cpp
+++ b/media/libmedia/AudioTrack.cpp
@@ -528,6 +528,15 @@ status_t AudioTrack::start()
         mTimestampStartupGlitchReported = false;
         mRetrogradeMotionReported = false;
 
+        // If previousState == STATE_STOPPED, we reactivate markers (mMarkerPosition != 0)
+        // as the position is reset to 0. This is legacy behavior. This is not done
+        // in stop() to avoid a race condition where the last marker event is issued twice.
+        // Note: the if is technically unnecessary because previousState == STATE_FLUSHED
+        // is only for streaming tracks, and mMarkerReached is already set to false.
+        if (previousState == STATE_STOPPED) {
+            mMarkerReached = false;
+        }
+
         // For offloaded tracks, we don't know if the hardware counters are really zero here,
         // since the flush is asynchronous and stop may not fully drain.
         // We save the time when the track is started to later verify whether
@@ -603,9 +612,9 @@ void AudioTrack::stop()
 
     mProxy->interrupt();
     mAudioTrack->stop();
-    // the playback head position will reset to 0, so if a marker is set, we need
-    // to activate it again
-    mMarkerReached = false;
+
+    // Note: legacy handling - stop does not clear playback marker
+    // and periodic update counter, but flush does for streaming tracks.
 
     if (mSharedBuffer != 0) {
         // clear buffer position and loop count.
diff --git a/media/libmedia/ICrypto.cpp b/media/libmedia/ICrypto.cpp
index 53b105d..5d822cf 100644
--- a/media/libmedia/ICrypto.cpp
+++ b/media/libmedia/ICrypto.cpp
@@ -301,8 +301,7 @@ status_t BnCrypto::onTransact(
                 secureBufferId = reinterpret_cast<void *>(static_cast<uintptr_t>(data.readInt64()));
                 AVMediaUtils::get()->readCustomData(&data, &secureBufferId);
             } else {
-                dstPtr = malloc(totalSize);
-                CHECK(dstPtr != NULL);
+                dstPtr = calloc(1, totalSize);
             }
 
             AString errorDetailMsg;
diff --git a/media/libmedia/IOMX.cpp b/media/libmedia/IOMX.cpp
index ac2e872..5356494 100644
--- a/media/libmedia/IOMX.cpp
+++ b/media/libmedia/IOMX.cpp
@@ -965,6 +965,12 @@ status_t BnOMX::onTransact(
 
             node_id node = (node_id)data.readInt32();
             OMX_U32 port_index = data.readInt32();
+            if (!isSecure(node) || port_index != 0 /* kPortIndexInput */) {
+                ALOGE("b/24310423");
+                reply->writeInt32(INVALID_OPERATION);
+                return NO_ERROR;
+            }
+
             size_t size = data.readInt64();
 
             buffer_id buffer;