diff options
Diffstat (limited to 'services')
| -rw-r--r-- | services/audioflinger/Effects.cpp | 6 | ||||
| -rw-r--r-- | services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp | 8 |
2 files changed, 14 insertions, 0 deletions
diff --git a/services/audioflinger/Effects.cpp b/services/audioflinger/Effects.cpp index 879b6c9..e57aab1 100644 --- a/services/audioflinger/Effects.cpp +++ b/services/audioflinger/Effects.cpp @@ -558,6 +558,12 @@ status_t AudioFlinger::EffectModule::command(uint32_t cmdCode, if (mStatus != NO_ERROR) { return mStatus; } + if (cmdCode == EFFECT_CMD_GET_PARAM && + (*replySize < sizeof(effect_param_t) || + ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t))) { + android_errorWriteLog(0x534e4554, "29251553"); + return -EINVAL; + } status_t status = (*mEffectInterface)->command(mEffectInterface, cmdCode, cmdSize, diff --git a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp index 66d7b00..9e6c0db 100644 --- a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp +++ b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp @@ -30,6 +30,7 @@ #include <utils/Trace.h> #include <gui/BufferItem.h> #include <gui/Surface.h> +#include <camera/ICameraRecordingProxy.h> #include <media/hardware/HardwareAPI.h> #include "common/CameraDeviceBase.h" @@ -826,6 +827,9 @@ status_t StreamingProcessor::processRecordingFrame() { (uint8_t*)heap->getBase() + offset); payload->eType = kMetadataBufferTypeANWBuffer; payload->pBuffer = imgBuffer.mGraphicBuffer->getNativeBuffer(); + // b/28466701 + payload->pBuffer = (ANativeWindowBuffer*)((uint8_t*)payload->pBuffer - + ICameraRecordingProxy::getCommonBaseAddress()); payload->nFenceFd = -1; ALOGVV("%s: Camera %d: Sending out ANWBuffer %p", @@ -874,6 +878,10 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) { return; } + // b/28466701 + payload->pBuffer = (ANativeWindowBuffer*)(((uint8_t*)payload->pBuffer) + + ICameraRecordingProxy::getCommonBaseAddress()); + // Release the buffer back to the recording queue size_t itemIndex; for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) { |