diff options
| author | Eino-Ville Talvala <etalvala@google.com> | 2016-06-20 17:00:14 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-06-23 15:05:18 -0700 |
| commit | 1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc (patch) | |
| tree | 240a349e5c0a5e783cd192317d3aa47c935861c2 /services | |
| parent | b351eabb428c7ca85a34513c64601f437923d576 (diff) | |
| download | frameworks_av-1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc.zip frameworks_av-1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc.tar.gz frameworks_av-1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc.tar.bz2 | |
DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak
Subtract address of a random static object from pointers being routed
through app process.
Bug: 28466701
Change-Id: Idcbfe81e9507433769672f3dc6d67db5eeed4e04
Diffstat (limited to 'services')
| -rw-r--r-- | services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp index 66d7b00..9e6c0db 100644 --- a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp +++ b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp @@ -30,6 +30,7 @@ #include <utils/Trace.h> #include <gui/BufferItem.h> #include <gui/Surface.h> +#include <camera/ICameraRecordingProxy.h> #include <media/hardware/HardwareAPI.h> #include "common/CameraDeviceBase.h" @@ -826,6 +827,9 @@ status_t StreamingProcessor::processRecordingFrame() { (uint8_t*)heap->getBase() + offset); payload->eType = kMetadataBufferTypeANWBuffer; payload->pBuffer = imgBuffer.mGraphicBuffer->getNativeBuffer(); + // b/28466701 + payload->pBuffer = (ANativeWindowBuffer*)((uint8_t*)payload->pBuffer - + ICameraRecordingProxy::getCommonBaseAddress()); payload->nFenceFd = -1; ALOGVV("%s: Camera %d: Sending out ANWBuffer %p", @@ -874,6 +878,10 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) { return; } + // b/28466701 + payload->pBuffer = (ANativeWindowBuffer*)(((uint8_t*)payload->pBuffer) + + ICameraRecordingProxy::getCommonBaseAddress()); + // Release the buffer back to the recording queue size_t itemIndex; for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) { |