summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* SoftAMR: check input buffer size to avoid overflow.Wei Jia2016-03-253-15/+25
| | | | | Bug: 27662364 Change-Id: I47380545ea7d85845e141e722b0d84f498d27145
* SoftAMR: check output buffer size to avoid overflow.Wei Jia2016-03-251-0/+18
| | | | | Bug: 27662364 Change-Id: I7b26892c41d6f2e690e77478ab855c2fed1ff6b0
* codecs: check OMX buffer size before use in VP8 encoder.Wonsik Kim2016-03-251-6/+22
| | | | | Bug: 27569635 Change-Id: I469573f40e21dc9f4c200749d4f220e3a2d31761
* NuPlayerStreamListener: NULL and bounds check before memcpyRobert Shih2016-03-251-1/+10
| | | | | Bug: 27533704 Change-Id: I992a7709b92b1cbc3114c97bec48a3fc5b22ba6e
* Camera3Device: Validate template IDChien-Yu Chen2016-03-251-0/+8
| | | | | | | | Validate template ID before creating a default request. Bug: 26866110 Bug: 27568958 Change-Id: Ifda457024f1d5c2b1382f189c1a8d5fda852d30d
* Add VPX output buffer size checkMarco Nelissen2016-03-252-10/+20
| | | | | | | and handle dead observers more gracefully Bug: 27597103 Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
* Get service by value instead of referenceMarco Nelissen2016-02-262-3/+3
| | | | | | | to prevent a cleared service binder from being used. Bug: 26040840 Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb
* Also fix out of bounds access for normal readMarco Nelissen2016-02-261-1/+9
| | | | | | | Previous fix accidentally only fixed the fragmented read case. Bug: 27208621 Change-Id: Ie16f1920b84c8aba613842659238fcd5925694ad
* Clear allocation to avoid info leakMarco Nelissen2016-02-261-27/+32
| | | | | Bug: 26914474 Change-Id: Ie1a86e86d78058d041149fe599a4996e7f8185cf
* Fixing safteynet logging bug introduced in ag/862848mspector@google.com2016-02-262-4/+1
| | | | | | We moved the safteynet logging into storeMetaDataInBuffers_l Bug: 26324358 Change-Id: I2171742b53192ebb71d546bcb8970bb3c68f366f
* 3 uninitialized variables in IOMX.cppmspector@google.com2016-02-261-3/+16
| | | | | | | | | | | | Uninitialized MetadataBufferType pointer in case: SET_INPUT_SURFACE STORE_META_DATA_IN_BUFFERS CREATE_INPUT_SURFACE Fix: initialize them to kMetadataBufferTypeInvalid Bug: 26324358 Change-Id: Ib3bcac9bedc98bc65efa39f67cdbffbd90b374c9
* Fix info leak vulnerability of IDrmJeff Tinker2016-02-261-1/+1
| | | | | bug: 26323455 Change-Id: I25bb30d3666ab38d5150496375ed2f55ecb23ba8
* IOMX.cpp uninitialized pointer in BnOMX::onTransactmspector@google.com2016-02-261-3/+5
| | | | | | | | | This can lead to local code execution in media server. Fix initializes the pointer and checks the error conditions before returning Bug: 26403627 Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
* Camera: Disallow dumping clients directlyEino-Ville Talvala2016-01-2210-6/+37
| | | | | | | | Camera service dumps should only be initiated through ICameraService::dump. Bug: 26265403 Change-Id: If3ca4718ed74bf33ad8a416192689203029e2803
* Fix out-of-bounds writeMarco Nelissen2016-01-221-1/+9
| | | | | Bug: 26365349 Change-Id: Ia363d9f8c231cf255dea852e0bbf5ca466c7990b
* fix possible overflow in effect wrappers.Eric Laurent2016-01-222-2/+8
| | | | | | | | | | Add checks on parameter size field in effect command handlers to avoid overflow leading to invalid comparison with min allowed size for command and reply buffers. Bug: 26347509. Change-Id: I20e6a9b6de8e5172b957caa1ac9410b9752efa4d (cherry picked from commit ad1bd92a49d78df6bc6e75bee68c517c1326f3cf)
* merge in mnc-mr1-release history after reset to mnc-dr-devThe Android Automerger2015-12-170-0/+0
|\
| * merge in mnc-mr1-release history after reset to mnc-dr-devThe Android Automerger2015-12-150-0/+0
| |\ | |/ |/|
* | Fix security vulnerability in ICrypto DO NOT MERGEJeff Tinker2015-12-101-1/+3
| | | | | | | | | | | | b/25800375 Change-Id: I03c9395f7c7de4ac5813a1207452aac57aa39484
* | libstagefright: check requested memory size before allocation for ↵Wei Jia2015-12-102-0/+18
|/ | | | | | | | SoftMPEG4Encoder and SoftVPXEncoder. Bug: 25812794 Change-Id: I96dc74734380d462583f6efa33d09946f9532809 (cherry picked from commit 87f8cbb223ee516803dbb99699320c2484cbf3ba)
* Reduce lock time for dump to make sure not locked when calling back to ↵Ronghua Wu2015-11-021-11/+26
| | | | | | | IResourceManagerClient. Bug: 25166048 Change-Id: I35f9917079c4b783a7cf4cef94b3c7112760c0b8
* ALooper::awaitResponse gets reply and returns immediately if the looper is ↵Ronghua Wu2015-11-021-16/+4
| | | | | | | stopped. Bug: 25088488 Change-Id: Id33d5d75f1173db52d00f4ff71d4c2c4f27f72f5
* GenericSource: reset mDecryptHandle when mDataSource is cleared. am: ↵Wei Jia2015-10-230-0/+0
|\ | | | | | | | | | | | | | | | | 09c291c838 am: 313358c747 am: 92b6cd8da9 am: 7b5564e251 am: 000321c7ee am: fd72a5b9e1 * commit 'fd72a5b9e1b7d36d8afb116b8e08c28ad444c188': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| * GenericSource: reset mDecryptHandle when mDataSource is cleared. am: ↵Wei Jia2015-10-221-0/+1
| |\ | | | | | | | | | | | | | | | | | | | | | | | | 09c291c838 am: 313358c747 am: 92b6cd8da9 am: 7b5564e251 am: 000321c7ee * commit '000321c7ee8c2a0e489d41b9a5f8bad93bdd89b2': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| | * GenericSource: reset mDecryptHandle when mDataSource is cleared. am: ↵Wei Jia2015-10-221-0/+1
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 09c291c838 am: 313358c747 am: 92b6cd8da9 am: 7b5564e251 * commit '7b5564e251680275d810b5c34b5d9a3caebff0fb': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| | | * GenericSource: reset mDecryptHandle when mDataSource is cleared. am: ↵Wei Jia2015-10-221-0/+1
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 09c291c838 am: 313358c747 am: 92b6cd8da9 * commit '92b6cd8da9052e17710945604cd45098ebfb25e0': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| | | | * GenericSource: reset mDecryptHandle when mDataSource is cleared. am: 09c291c838Wei Jia2015-10-221-0/+1
| | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 313358c747 * commit '313358c747b54bbdcbff97636546e0304f6f4947': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| | | | | * GenericSource: reset mDecryptHandle when mDataSource is cleared.Wei Jia2015-10-221-0/+1
| | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 09c291c838 * commit '09c291c838bc74bb7c10c22f7232abb946cad8ff': GenericSource: reset mDecryptHandle when mDataSource is cleared.
| | | | | | * GenericSource: reset mDecryptHandle when mDataSource is cleared.Wei Jia2015-10-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25070434 Change-Id: Ib0eb6a419683a0e686a4f63b82e9300cb1f69484 (cherry picked from commit cdc9cf656a8e43875234cb021fffeb4792d7c74e)
* | | | | | | Merge "Workaround for busy wait bug" into mnc-dr-devGlenn Kasten2015-10-221-1/+2
|\ \ \ \ \ \ \
| * | | | | | | Workaround for busy wait bugGlenn Kasten2015-10-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Underlying bug 25195759 is not yet fixed. Bug: 24263351 Change-Id: I04b644246640054d38c8de79e0eb80fcbfef0e48
* | | | | | | | Merge "Allow ALooper::awaitResponse to return immediately if the looper is ↵Ronghua Wu2015-10-222-3/+30
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | stopped." into mnc-dr-dev
| * | | | | | | | Allow ALooper::awaitResponse to return immediately if the looper is stopped.Ronghua Wu2015-10-222-3/+30
| |/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25088488 Change-Id: I63e69886a8e9cffcaad675ca1a5642c0abf3b466
* | | | | | | | Merge "GenericSource: reset mDecryptHandle when mDataSource is cleared." ↵Wei Jia2015-10-221-0/+1
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | into mnc-dr-dev
| * | | | | | | | GenericSource: reset mDecryptHandle when mDataSource is cleared.Wei Jia2015-10-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25070434 Change-Id: Ib0eb6a419683a0e686a4f63b82e9300cb1f69484
* | | | | | | | | Merge "Fix offset adjustment when skipping off-spec meta chunk" into mnc-dr-devMarco Nelissen2015-10-221-3/+3
|\ \ \ \ \ \ \ \ \ | |/ / / / / / / / |/| | | | | | | |
| * | | | | | | | Fix offset adjustment when skipping off-spec meta chunkMarco Nelissen2015-10-221-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25172843 Change-Id: Ibbfe4369176f2a367eab5a39fd742f425b017288
* | | | | | | | | Merge "DO NOT MERGE: libcameraservice: Fix nullptr crash when no client." ↵Ian Pedowitz2015-10-221-2/+4
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into mnc-dr-dev
| * | | | | | | | | DO NOT MERGE: libcameraservice: Fix nullptr crash when no client.Tom Keel2015-10-211-2/+4
| | |/ / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change prevents a crash in the camera service when the camera HAL notifies the service about the absence of a removable camera and there happens to be no client connected to the service. It checks that the pointer returned from clientToDisconnect.get() is non-null before trying to dereference it (as is done in existing code immediately below this change). Bug: 25165323 Change-Id: I8055654bac980542e63ea7f52bf897eaafbc09bc Signed-off-by: Tom Keel <thomas.keel@intel.com>
* | | | | | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared. am: ↵Wei Jia2015-10-210-0/+0
|\ \ \ \ \ \ \ \ \ | | |_|/ / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 224858e719 am: 69c8e36da7 am: 3fcddfd23a am: e01ba47052 am: adadada4f0 am: ddb3d77dad * commit 'ddb3d77dad1766708fdb18cc48e60a663ee8e2e1': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| * | | | | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared. am: ↵Wei Jia2015-10-211-0/+1
| |\ \ \ \ \ \ \ \ | | | |_|/ / / / / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 224858e719 am: 69c8e36da7 am: 3fcddfd23a am: e01ba47052 am: adadada4f0 * commit 'adadada4f00eaf44bbc616be7a7d30010750560e': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| | * | | | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared. am: ↵Wei Jia2015-10-211-0/+1
| | |\ \ \ \ \ \ \ | | | | |_|/ / / / | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 224858e719 am: 69c8e36da7 am: 3fcddfd23a am: e01ba47052 * commit 'e01ba470525155c1c36e53d242a12a778069a5bc': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| | | * | | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared. am: ↵Wei Jia2015-10-211-0/+1
| | | |\ \ \ \ \ \ | | | | | |_|/ / / | | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 224858e719 am: 69c8e36da7 am: 3fcddfd23a * commit '3fcddfd23adc88116c8fe5ea593626bfce0b75bd': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| | | | * | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared. am: ↵Wei Jia2015-10-211-0/+1
| | | | |\ \ \ \ \ | | | | | | |_|/ / | | | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 224858e719 am: 69c8e36da7 * commit '69c8e36da7137730f4789a0d27d983b40d1f2917': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| | | | | * | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared.Wei Jia2015-10-211-0/+1
| | | | | |\ \ \ \ | | | | | | | |_|/ | | | | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 224858e719 * commit '224858e719d045c8554856b12c4ab73d2375cf33': GenericSource: reset mDrmManagerClient when mDataSource is cleared.
| | | | | | * | | GenericSource: reset mDrmManagerClient when mDataSource is cleared.Wei Jia2015-10-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25070434 Change-Id: Iade3472c496ac42456e42db35e402f7b66416f5b (cherry picked from commit b41fd0d4929f0a89811bafcc4fd944b128f00ce2)
* | | | | | | | | Merge "GenericSource: reset mDrmManagerClient when mDataSource is cleared." ↵Wei Jia2015-10-211-0/+1
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into mnc-dr-dev
| * | | | | | | | | GenericSource: reset mDrmManagerClient when mDataSource is cleared.Wei Jia2015-10-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 25070434 Change-Id: Iade3472c496ac42456e42db35e402f7b66416f5b
* | | | | | | | | | Merge "stagefright: MPEG4Extractor: allow \'hdlr\' box before first track" ↵Jon Larimer2015-10-210-0/+0
|\ \ \ \ \ \ \ \ \ \ | | |/ / / / / / / / | |/| | | | | | / / | |_|_|_|_|_|_|/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into klp-dev am: b1a13d01dc am: 781cd4f37d am: 8565726f57 am: b44e95da77 am: 699e9b0749 am: 8e4f53159c am: 8fbf202f7b am: e20b0eb88c * commit 'e20b0eb88c7593c13105b47ce383113fad247d85': stagefright: MPEG4Extractor: allow 'hdlr' box before first track
| * | | | | | | | Merge "stagefright: MPEG4Extractor: allow \'hdlr\' box before first track" ↵Jon Larimer2015-10-210-0/+0
| |\ \ \ \ \ \ \ \ | | | |/ / / / / / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into klp-dev am: b1a13d01dc am: 781cd4f37d am: 8565726f57 am: b44e95da77 am: 699e9b0749 am: 8e4f53159c am: 8fbf202f7b * commit '8fbf202f7b9fa461f07b49470c2a6afe39ca6afd': stagefright: MPEG4Extractor: allow 'hdlr' box before first track
generated by cgit v1.1 at 2024-05-19 22:10:34 +0000