summaryrefslogtreecommitdiffstats
path: root/media/libmedia
Commit message (Collapse)AuthorAgeFilesLines
* IOMX: work against metadata buffer spoofingLajos Molnar2016-09-271-5/+9
| | | | | | | | | | | | | | | | - Prohibit direct set/getParam/Settings for extensions meant for OMXNodeInstance alone. This disallows enabling metadata mode without the knowledge of OMXNodeInstance. - Do not share metadata mode buffers cross process. - Disallow setting up metadata mode/tunneling/input surface after first sendCommand. - Disallow store-meta for input cross process. - Disallow emptyBuffer for surface input (via IOMX). - Fix checking for input surface. Bug: 29422020 Change-Id: I801c77b80e703903f62e42d76fd2e76a34e4bc8e (cherry picked from commit f8a4cb410115045278f534e54b41ac78d6bf6c07)
* Don't use sp<>&Marco Nelissen2016-06-233-5/+5
| | | | | | | because they may end up pointing to NULL after a NULL check was performed. Bug: 28166152 Change-Id: Iab2ea30395b620628cc6f3d067dd4f6fcda824fe
* limit mediaserver memoryMarco Nelissen2016-05-273-0/+110
| | | | | | | | | | Limit mediaserver using rlimit, to prevent it from bringing down the system via the low memory killer. Default max is 65% of total RAM, but can be customized via system property. Bug: 28471206 Bug: 28615448 Change-Id: Ic84137435d1ef0a6883e9789a4b4f399e4283f05
* Fix OMX_IndexParamConsumerUsageBits size checkMarco Nelissen2016-04-211-3/+4
| | | | | Bug: 27207275 Change-Id: I9a7c9fb22a0e84a490ff09c151bd2f88141fdbc0
* Fix size check for OMX_IndexParamConsumerUsageBitsMarco Nelissen2016-04-211-2/+6
| | | | | | | | since it doesn't follow the OMX convention. And remove support for the kClientNeedsFrameBuffer flag. Bug: 27207275 Change-Id: Ia2c119e2456ebf9e2f4e1de5104ef9032a212255
* DO NOT MERGE Verify OMX buffer sizes prior to accessMarco Nelissen2016-04-211-30/+66
| | | | | Bug: 27207275 Change-Id: I4412825d1ee233d993af0a67708bea54304ff62d
* Get service by value instead of referenceMarco Nelissen2016-02-261-2/+2
| | | | | | | to prevent a cleared service binder from being used. Bug: 26040840 Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb
* Clear allocation to avoid info leakMarco Nelissen2016-02-261-27/+32
| | | | | Bug: 26914474 Change-Id: Ie1a86e86d78058d041149fe599a4996e7f8185cf
* Fixing safteynet logging bug introduced in ag/862848mspector@google.com2016-02-261-4/+0
| | | | | | We moved the safteynet logging into storeMetaDataInBuffers_l Bug: 26324358 Change-Id: I2171742b53192ebb71d546bcb8970bb3c68f366f
* 3 uninitialized variables in IOMX.cppmspector@google.com2016-02-261-3/+16
| | | | | | | | | | | | Uninitialized MetadataBufferType pointer in case: SET_INPUT_SURFACE STORE_META_DATA_IN_BUFFERS CREATE_INPUT_SURFACE Fix: initialize them to kMetadataBufferTypeInvalid Bug: 26324358 Change-Id: Ib3bcac9bedc98bc65efa39f67cdbffbd90b374c9
* Fix info leak vulnerability of IDrmJeff Tinker2016-02-261-1/+1
| | | | | bug: 26323455 Change-Id: I25bb30d3666ab38d5150496375ed2f55ecb23ba8
* IOMX.cpp uninitialized pointer in BnOMX::onTransactmspector@google.com2016-02-261-3/+5
| | | | | | | | | This can lead to local code execution in media server. Fix initializes the pointer and checks the error conditions before returning Bug: 26403627 Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
* Fix security vulnerability in ICrypto DO NOT MERGEJeff Tinker2015-12-101-1/+3
| | | | | | b/25800375 Change-Id: I03c9395f7c7de4ac5813a1207452aac57aa39484
* Workaround for busy wait bugGlenn Kasten2015-10-221-1/+2
| | | | | | | Underlying bug 25195759 is not yet fixed. Bug: 24263351 Change-Id: I04b644246640054d38c8de79e0eb80fcbfef0e48
* Merge "For static obtainBuffer(), do not set mUnreleased if acknowledging ↵Glenn Kasten2015-10-141-2/+4
|\ | | | | | | flush." into mnc-dr-dev
| * For static obtainBuffer(), do not set mUnreleased if acknowledging flush.Andy Hung2015-10-131-2/+4
| | | | | | | | | | | | | | static audio tracks use obtainBuffer() to update position in start(). Bug: 22938515 Change-Id: I8ae32f6cce4d122386d2cf8982e158049b04ba9a
* | AudioTrack: Skip callback EVENT_STREAM_END on DEAD_OBJECT.Andy Hung2015-10-131-1/+5
|/ | | | | | | Send only EVENT_NEW_IAUDIOTRACK to initiate teardown. Bug: 23750452 Change-Id: Ib5dcd578b5b6a6a1d91a03e58ef8da0acd994243
* Merge "AudioTrack: Prevent stop() from reissuing last marker event" into ↵Glenn Kasten2015-10-071-3/+12
|\ | | | | | | mnc-dr-dev
| * AudioTrack: Prevent stop() from reissuing last marker eventAndy Hung2015-10-061-3/+12
| | | | | | | | | | | | | | | | Avoid a duplicate marker event race condition (1 in 30 or less) by clearing marker reached in start() not stop(). Bug: 24497521 Change-Id: I9520d063c7d173d2e642174bf60a2bfe75edf085
* | am cb70fdbe: Merge "OMX: allow only secure codec to remotely call ↵Wei Jia2015-10-061-0/+6
|\ \ | | | | | | | | | | | | | | | | | | allocateBuffer." into mnc-dev * commit 'cb70fdbe9be14002a4303a93f07a13c508c00d89': OMX: allow only secure codec to remotely call allocateBuffer.
| * | OMX: allow only secure codec to remotely call allocateBuffer.Wei Jia2015-10-021-0/+6
| |/ | | | | | | | | Bug: 24310423 Change-Id: Iebcfc58b447f925ec2134898060af2ef227266a3
* | AudioSystem: Fix race condition in accessing ioDescriptorsPraveen Chavan2015-10-051-4/+10
|/ | | | | | | | | | | | The vector mIoDescriptors can be simultaneouly modified and accessed by 2 threads. Acquire a lock while wrapping the ioDescriptor in a sp<> Bug: 24576810 Author: Haynes Mathew George <hgeorge@codeaurora.org> Change-Id: I73c79ef8eca092b500a7ead3a5ebd0bcf75f9920
* Merge "DO NOT MERGE Fix vulnerability in mediaserver" into mnc-devJeff Tinker2015-09-171-1/+1
|\
| * DO NOT MERGE Fix vulnerability in mediaserverJeff Tinker2015-09-161-1/+1
| | | | | | | | | | | | | | ICrypto.cpp: ASLR bypass using DECRYPT IPC bug: 24074485 Change-Id: I61cd77f0894140547f666a80526ebfe1ec3d2db6
* | IAudioFlinger: fix the missing initialization of variable to ensure no info ↵Wei Jia2015-09-161-1/+1
| | | | | | | | | | | | | | leak when writing them to Parcel. Bug: 23953967 Change-Id: I3a1d0144ba3832649e322c197ff0f03305ee7829
* | IAudioFlinger: always initialize variables to ensure no info leak when ↵Wei Jia2015-09-102-15/+15
| | | | | | | | | | | | | | writing them to Parcel. Bug: 23953967 Change-Id: Ibbe841da149038675e9e8daea76c77558bc8564b
* | IAudioFlinger: clear config before reading it from parcel.Wei Jia2015-09-092-15/+29
|/ | | | | | Bug: 23905951 Bug: 23912202 Change-Id: Id13a9d3cae2c09e7381b841e67ddfb188274d74c
* am becceb11: am b57ffbb5: am d021f7e5: am b18c0276: am 2b63b91b: am ↵Robert Shih2015-09-042-3/+3
|\ | | | | | | | | | | | | c1e989e7: am 13ff64c2: Merge "Zero out return values in media binder calls" into klp-dev * commit 'becceb1136e7eb01db7dd865cb98a57117212879': Zero out return values in media binder calls
| * am b57ffbb5: am d021f7e5: am b18c0276: am 2b63b91b: am c1e989e7: am ↵Robert Shih2015-09-042-3/+3
| |\ | | | | | | | | | | | | | | | | | | 13ff64c2: Merge "Zero out return values in media binder calls" into klp-dev * commit 'b57ffbb5486a58e0dbb03466e9f3a5e51d6cf0f3': Zero out return values in media binder calls
| | * am b18c0276: am 2b63b91b: am c1e989e7: am 13ff64c2: Merge "Zero out return ↵Robert Shih2015-09-042-3/+3
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | values in media binder calls" into klp-dev * commit 'b18c02761fe357599f9dad17355e38ec1d3226f2': Zero out return values in media binder calls
| | | * am c1e989e7: am 13ff64c2: Merge "Zero out return values in media binder ↵Robert Shih2015-09-032-3/+3
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | calls" into klp-dev * commit 'c1e989e76a461ea69e293839b3c29b634a462bd5': Zero out return values in media binder calls
| | | | * am 13ff64c2: Merge "Zero out return values in media binder calls" into klp-devRobert Shih2015-09-032-3/+3
| | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | * commit '13ff64c2db84f4e7cac3396700e333b48c42c7ee': Zero out return values in media binder calls
| | | | | * Merge "Zero out return values in media binder calls" into klp-devRobert Shih2015-09-032-3/+3
| | | | | |\
| | | | | | * Zero out return values in media binder callsRobert Shih2015-09-022-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | More specifically when handling: * GET_STREAM_VOLUME in IAudioPolicyService, and * GET_CURRENT_POSITION and GET_DURATION in IMediaPlayer This prevents leaking uninitialized values across binder in error cases. Bug: 23756261 Change-Id: I0ffd900ab12b685b0611259ade4a3efb1ec5defe
* | | | | | | am 7734e37e: am a1179678: am be695f0a: am 5e193041: am 52a4fc09: am ↵Andy Hung2015-09-041-7/+20
|\ \ \ \ \ \ \ | |/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3732a3ac: am ab203130: Merge "Make IEffect command more robust (second try)" into klp-dev * commit '7734e37efe4ad47d91cdc5cfa6703d77a7a2ac0c': Make IEffect command more robust (second try)
| * | | | | | am a1179678: am be695f0a: am 5e193041: am 52a4fc09: am 3732a3ac: am ↵Andy Hung2015-09-041-7/+20
| |\ \ \ \ \ \ | | |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ab203130: Merge "Make IEffect command more robust (second try)" into klp-dev * commit 'a1179678752e5755297a2bb66c730f4fd22856e3': Make IEffect command more robust (second try)
| | * | | | | am 5e193041: am 52a4fc09: am 3732a3ac: am ab203130: Merge "Make IEffect ↵Andy Hung2015-09-041-7/+20
| | |\ \ \ \ \ | | | |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | command more robust (second try)" into klp-dev * commit '5e193041ab8a541b478dd1b61c8c8cd24bca2ab5': Make IEffect command more robust (second try)
| | | * | | | am 3732a3ac: am ab203130: Merge "Make IEffect command more robust (second ↵Andy Hung2015-09-031-7/+20
| | | |\ \ \ \ | | | | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | try)" into klp-dev * commit '3732a3acafa7eb621bc26cca3eb00150ea12d2e2': Make IEffect command more robust (second try)
| | | | * | | am ab203130: Merge "Make IEffect command more robust (second try)" into klp-devAndy Hung2015-09-031-7/+20
| | | | |\ \ \ | | | | | |/ / | | | | | | | | | | | | | | | | | | | | | * commit 'ab20313074bb109f29f677c3f09d5da1a48c94e7': Make IEffect command more robust (second try)
| | | | | * | Make IEffect command more robust (second try)Andy Hung2015-09-021-7/+20
| | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 23540907 Change-Id: If30cfa535ad51521053706fc40fc98d893db5bc7 (cherry picked from commit 10e6660cc5da65b027c90489ba7ac55d1504e012)
* | | | | | am 4abb48c3: am 898e8575: am 72b0abdf: Merge "Zero out return values in ↵Robert Shih2015-09-031-1/+1
|\ \ \ \ \ \ | |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | audio binder calls" into lmp-mr1-dev * commit '4abb48c30cd7821f3397ccd7de8deb3eb645b385': Zero out return values in audio binder calls
| * | | | | am 898e8575: am 72b0abdf: Merge "Zero out return values in audio binder ↵Robert Shih2015-09-031-1/+1
| |\ \ \ \ \ | | |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | calls" into lmp-mr1-dev * commit '898e857594b738f88be4de5addc8ca296dfabd74': Zero out return values in audio binder calls
| | * | | | Zero out return values in audio binder callsRobert Shih2015-09-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | More specifically when handling GET_OUTPUT_FOR_ATTR in IAudioPolicyService. This prevents leaking a uninitialized `output` across binder if getOutputForAttr were to encounter errors. Bug: 23756261 Change-Id: Ibff8a1249a4e8a3c89a33a540dda428b10d6ca82
| * | | | | am 6b203f06: am 66b24004: am 0ea9e276: am 184ad88d: am fba72ab0: am ↵Andy Hung2015-08-281-2/+2
| |\ \ \ \ \ | | |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | f394f121: Merge "libmedia: clear reply data for IEffect command" into klp-dev * commit '6b203f06b969ba92181dbf781544b40cc2c41b7c': libmedia: clear reply data for IEffect command
| | * | | | am 0ea9e276: am 184ad88d: am fba72ab0: am f394f121: Merge "libmedia: clear ↵Andy Hung2015-08-281-2/+2
| | |\ \ \ \ | | | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reply data for IEffect command" into klp-dev * commit '0ea9e2761a04c4f592d854dbde2749395735fe56': libmedia: clear reply data for IEffect command
| | | * | | am fba72ab0: am f394f121: Merge "libmedia: clear reply data for IEffect ↵Andy Hung2015-08-281-2/+2
| | | |\ \ \ | | | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | command" into klp-dev * commit 'fba72ab0fcf7298492dcd9e3045913435d30d3a9': libmedia: clear reply data for IEffect command
| | | | * | am f394f121: Merge "libmedia: clear reply data for IEffect command" into klp-devAndy Hung2015-08-281-2/+2
| | | | |\ \ | | | | | |/ | | | | | | | | | | | | | | | | | | * commit 'f394f12167fddbc755855d06b615509517c99f14': libmedia: clear reply data for IEffect command
| | | | | * Merge "libmedia: clear reply data for IEffect command" into klp-devAndy Hung2015-08-281-2/+2
| | | | | |\
| | | | | | * libmedia: clear reply data for IEffect commandAndy Hung2015-08-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 23540907 Change-Id: Ib89afc6b273b0eb310bbc5a1bd92b1e3d407c249
* | | | | | | Merge "Fix for security vulnerability in media server" into mnc-devJeff Tinker2015-08-281-1/+19
|\ \ \ \ \ \ \
generated by cgit v1.1 at 2024-05-04 14:17:00 +0000