summaryrefslogtreecommitdiffstats
path: root/media
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'android-6.0.1_r24' into HEADJessica Wagantall2016-04-055-37/+62
|\ | | | | | | | | Ticket: CYNGNOS-2213 Android 6.0.1 release 24
| * Get service by value instead of referenceMarco Nelissen2016-03-011-2/+2
| | | | | | | | | | | | | | to prevent a cleared service binder from being used. Bug: 26040840 Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb
| * Also fix out of bounds access for normal readMarco Nelissen2016-03-011-1/+9
| | | | | | | | | | | | | | Previous fix accidentally only fixed the fragmented read case. Bug: 27208621 Change-Id: Ie16f1920b84c8aba613842659238fcd5925694ad
| * Clear allocation to avoid info leakMarco Nelissen2016-03-011-27/+32
| | | | | | | | | | Bug: 26914474 Change-Id: Ie1a86e86d78058d041149fe599a4996e7f8185cf
| * Fixing safteynet logging bug introduced in ag/862848mspector@google.com2016-03-012-4/+1
| | | | | | | | | | | | We moved the safteynet logging into storeMetaDataInBuffers_l Bug: 26324358 Change-Id: I2171742b53192ebb71d546bcb8970bb3c68f366f
| * 3 uninitialized variables in IOMX.cppmspector@google.com2016-03-011-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | Uninitialized MetadataBufferType pointer in case: SET_INPUT_SURFACE STORE_META_DATA_IN_BUFFERS CREATE_INPUT_SURFACE Fix: initialize them to kMetadataBufferTypeInvalid Bug: 26324358 Change-Id: Ib3bcac9bedc98bc65efa39f67cdbffbd90b374c9
| * Fix info leak vulnerability of IDrmJeff Tinker2016-03-011-1/+1
| | | | | | | | | | bug: 26323455 Change-Id: I25bb30d3666ab38d5150496375ed2f55ecb23ba8
| * IOMX.cpp uninitialized pointer in BnOMX::onTransactmspector@google.com2016-03-011-3/+5
| | | | | | | | | | | | | | | | | | This can lead to local code execution in media server. Fix initializes the pointer and checks the error conditions before returning Bug: 26403627 Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500
* | audio: Update anchor time only when sink start is successfulPreetam Singh Ranawat2016-04-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | - During offload (WH) to non-offload fallback (BT), anchor time is getting updated incorrectly with offload renderer position when it tries to start sink using offload mode only. - update anchor time post resume only when sink is started successfully. Change-Id: I2c2992afa90506e08389226964b0bd5a5be07529 CRs-Fixed: 978596
* | Avoid parsing CC SEI payload beyond buffer endPatrik2 Carlsson2016-03-221-0/+6
| | | | | | | | | | | | | | Break CC SEI parsing when payload size exceeds buffer size to avoid a CHECK that have been seen in MTBF statistics. Change-Id: Ifd97648678a935ac815dd616301d46f9bf583838
* | MPEG4Extractor: cast media time to int64_t in order to avoid check on ↵Wei Jia2016-03-221-1/+1
| | | | | | | | | | | | unsigned integer overflow. Change-Id: Iad5ae41f0bbfc5e837b4b78e8acaa3f9462329e6
* | Overflow fixes for amrwbencMarco Nelissen2016-03-224-16/+26
| | | | | | | | | | | | | | Most of these were encountered while running a mixed sanitized/unsanitized AMR encoder, so may not be reachable in real conditions. Change-Id: I85af7d40214133234009323e7e64432fc1be39ca
* | Fix benign integer overflow conditions for VSYNC add and removal.Dan Austin2016-03-221-2/+4
| | | | | | | | | | | | | | | | | | | | There are integer overflow conditions that could occur on vsyncsForLastFrame in VideoFrameScheduler::schedule upon a VSYNC add or removal. Additional checks have been put in place to remove the overflowable conditions. Bug: 24980200 Change-Id: I7dfc25ae1d2f3e3b3382e990adb3c56518c64e8d
* | Fix harmless unsigned overflow in recoverPTSChad Brubaker2016-03-221-1/+1
| | | | | | | | Change-Id: I89e3a827cf566421e8dd9b6a3c842e73a19c140f
* | Fix integer overflow in time conversionMarco Nelissen2016-03-221-1/+5
| | | | | | | | | | | | | | | | Converting unix epoch time to mpeg4 time requires adding over 2B seconds, which caused an overflow in a calculation involving time_t, which is signed. Bug: 23574783 Change-Id: I21bacc9f5a422091f3c903fb8cf1c760fc078953
* | Prevent divide by zero in WAVExtractorJoshua J. Drake2016-03-221-2/+10
| | | | | | | | | | | | | | | | | | | | | | In the case that mNumChannels, bytesPerSample, or mSampleRate are zero, a divide by zero occurs. None of these parameters of a WAV file should ever be zero. Check that they aren't and return an error otherwise. Bug: 23285883 Change-Id: Id67b8620944405ca59572221f6f1c2b19c363e69
* | OMXCodec: fix potential OOB read in parseHEVCCodecSpecificDataRobert Shih2016-03-221-1/+4
| | | | | | | | | | Bug: 23279597 Change-Id: Ibaa3d52e586e65230ec6df3680d9456ce873390c
* | Prevent integer underflows in ID3::IteratorJoshua J. Drake2016-03-222-0/+11
| | | | | | | | | | | | | | | | | | | | | | If mFrameSize is less than or equal to getHeaderLength(), an integer underflow will occur. This typically leads to a crash reading out of bounds in the following code. Prevent this from happening by validating mFrameSize. Also add NULL checks after references to ID3::Iterator::getData. Bug: 23285887 Change-Id: I35eeda3c5349ebbd9ffb3ea49b79af6a940d1395
* | Stagefright: Remove unused variables and filesAndreas Gampe2016-03-226-510/+0
| | | | | | | | | | | | | | | | | | | | For build-system CFLAGS clean-up. Bug: 18632512 (cherry picked from commit 765b4172f1ffb2c4e2de89163bb888fa352de664) Change-Id: I765dc394f39f60801843851760fdf9838958d7a4
* | h264dec: Use intptr_t when a pointer is treated as an integerAshok Bhat2016-03-222-6/+6
| | | | | | | | | | Change-Id: I83057565a842da31ee137fac674af496c1fc18af Signed-off-by: Ashok Bhat <ashok.bhat@arm.com>
* | MPEG4Extractor: still more NULL dereference fixesJoshua J. Drake2016-03-221-0/+3
| | | | | | | | | | | | | | | | | | When processing various FourCC values within MP4 media, mLastTrack is accessed without first ensuring that a track has been encoutered. Check for NULL and bail out instead of crashing. Bug: 20139950 Change-Id: Ie16687024d17348f576a0e13bd60bd4d6898de91
* | Use errno correctly.tao.pei2016-03-221-14/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After a failed write() or ioctl(), errno wasn't being checked until after some other function calls that could also modify errno, thus checking the wrong errno. Make sure to check it prior to doing anything else that can modify it. [Preconditions] 1.PC connects with phone(mtp). [Procedures] 1.Copy a file from PC to phone. 2.Cancel the copying. 3.Recopy the file. Change-Id: Id772fca7ccb96d3f43bd4beb210bedd8d3ac17fa
* | Fix 64-bit comparisonMarco Nelissen2016-03-221-1/+6
| | | | | | | | | | | | | | A 64-bit SIZE_MAX value cast to off64_t is always negative, causing valid files to be rejected in 64-bit mode. Change-Id: I8f61c19951f9c73292fa917081b8b2f3bfc405a0
* | Revert "Fixed comparison on 64 bit system"Keith Mok2016-03-221-1/+1
| | | | | | | | | | | | | | | | AOSP has a different fix. This reverts commit 65890a73d53a25b0809b22e41cdee19e3f4aa68d. Change-Id: I88fc05c791b9d5cef181e94d1cd3c40f0076f827
* | Merge branch 'dr15' into cm-13.0Steve Kondik2016-03-121-2/+7
|\ \
| * \ Merge tag 'android-6.0.1_r22' of ↵Steve Kondik2016-03-101-2/+7
| |\ \ | | |/ | | | | | | | | | | | | https://android.googlesource.com/platform/frameworks/av into cm-13.0 Android 6.0.1 release 22
| | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: ↵Marco Nelissen2016-01-121-1/+9
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 am: a39f981875 am: e463301aa4 am: 0dd00d9b19 * commit '0dd00d9b1986cd2cc4f45bdb96266dee01f20d72': Fix out-of-bounds write
| | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: ↵Marco Nelissen2016-01-121-1/+9
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 am: a39f981875 am: e463301aa4 * commit 'e463301aa44f0ea0ae1a2399bf8800d94cf6ce3e': Fix out-of-bounds write
| | | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: ↵Marco Nelissen2016-01-121-1/+9
| | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 am: a39f981875 * commit 'a39f9818759155a2651995d6844f9821d83e3f0d': Fix out-of-bounds write
| | | | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: ↵Marco Nelissen2016-01-121-1/+9
| | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a8ac8f617b am: e2e46f5fa1 am: 2304c606eb am: 0945199000 * commit '0945199000aaa5a628705de69f17d28a5c04cc36': Fix out-of-bounds write
| | | | | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7e am: ↵Marco Nelissen2016-01-121-1/+9
| | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a8ac8f617b am: e2e46f5fa1 am: 2304c606eb * commit '2304c606eb2eb9e6f21fcca0e6dcd4ac8156779a': Fix out-of-bounds write
| | | | | | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102 am: e6bd186c7eMarco Nelissen2016-01-121-1/+9
| | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: a8ac8f617b * commit 'a8ac8f617b2df8f07935d3e1e47189dee2381b88': Fix out-of-bounds write
| | | | | | | | * Fix out-of-bounds write am: 5403587a74 am: fb2eb86102Marco Nelissen2016-01-121-1/+9
| | | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: e6bd186c7e * commit 'e6bd186c7e2a3b948fdd27a4b71048ee85229e7c': Fix out-of-bounds write
| | | | | | | | | * Fix out-of-bounds write am: 5403587a74Marco Nelissen2016-01-121-1/+9
| | | | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: fb2eb86102 * commit 'fb2eb8610208d3ad2ea69f57a151ffe436c6c6e6': Fix out-of-bounds write
| | | | | | | | | | * Fix out-of-bounds writeMarco Nelissen2016-01-121-1/+9
| | | | | | | | | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 5403587a74 * commit '5403587a74aee2fb57076528c3927851531c8afb': Fix out-of-bounds write
| | | | | | | | | | | * Fix out-of-bounds writeMarco Nelissen2016-01-121-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug: 26365349 Change-Id: Ia363d9f8c231cf255dea852e0bbf5ca466c7990b
| | | | | | * | | | | | DO NOT MERGE ANYWHERE Revert "fix possible overflow in effect wrappers."Eric Laurent2016-01-122-8/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 9e29523b9537983b4c4b205ff868d0b3bca0383b. Change-Id: Ic9a97d1a98165500dd444b97629349cf082ced94
| | * | | | | | | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | |\ \ \ \ \ \ \ \ \ \ | | | |/ / / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e am: df81fc3f3c am: 68e43cf141 am: b1338d3cfc am: 440c9e9b72 am: 9950df2504 am: de98d9b7c1 * commit 'de98d9b7c19882dd8c3394c7653ed2eeccee713c': fix possible overflow in effect wrappers.
| | | * | | | | | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | | |\ \ \ \ \ \ \ \ \ | | | | |/ / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e am: df81fc3f3c am: 68e43cf141 am: b1338d3cfc am: 440c9e9b72 am: 9950df2504 * commit '9950df2504daeb1bde86603065ef072155e48ecf': fix possible overflow in effect wrappers.
| | | | * | | | | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | | | |\ \ \ \ \ \ \ \ | | | | | |/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e am: df81fc3f3c am: 68e43cf141 am: b1338d3cfc am: 440c9e9b72 * commit '440c9e9b72277d6fc6cea630b9ab50f12687a9c0': fix possible overflow in effect wrappers.
| | | | | * | | | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | | | | |\ \ \ \ \ \ \ | | | | | | |/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e am: df81fc3f3c am: 68e43cf141 am: b1338d3cfc * commit 'b1338d3cfcb47d0fc5f21e2b939d66316b307fe3': fix possible overflow in effect wrappers.
| | | | | | * | | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | | | | | |\ \ \ \ \ \ | | | | | | | |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e am: df81fc3f3c am: 68e43cf141 * commit '68e43cf141a5851c242bce776dff93f7136cbea6': fix possible overflow in effect wrappers.
| | | | | | | * | | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0 am: ↵Eric Laurent2016-01-122-2/+8
| | | | | | | |\ \ \ \ \ | | | | | | | | |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3a9d4f4a83 am: 5b7c20dd1e * commit '5b7c20dd1ee9eff7f96676cec68d4b74e33440e7': fix possible overflow in effect wrappers.
| | | | | | | | * | | | fix possible overflow in effect wrappers. am: 9e29523b95 am: baebc739b0Eric Laurent2016-01-122-2/+8
| | | | | | | | |\ \ \ \ | | | | | | | | | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 3a9d4f4a83 * commit '3a9d4f4a83341e4c083aa50a651fe5d765ef70ad': fix possible overflow in effect wrappers.
| | | | | | | | | * | | fix possible overflow in effect wrappers. am: 9e29523b95Eric Laurent2016-01-122-2/+8
| | | | | | | | | |\ \ \ | | | | | | | | | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: baebc739b0 * commit 'baebc739b0fe7257b26bfe105b67409559171c82': fix possible overflow in effect wrappers.
| | | | | | | | | | * | fix possible overflow in effect wrappers.Eric Laurent2016-01-122-2/+8
| | | | | | | | | | |\ \ | | | | | | | | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 9e29523b95 * commit '9e29523b9537983b4c4b205ff868d0b3bca0383b': fix possible overflow in effect wrappers.
| | | | | | | | | | | * fix possible overflow in effect wrappers.Eric Laurent2016-01-112-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add checks on parameter size field in effect command handlers to avoid overflow leading to invalid comparison with min allowed size for command and reply buffers. Bug: 26347509. Change-Id: I20e6a9b6de8e5172b957caa1ac9410b9752efa4d (cherry picked from commit ad1bd92a49d78df6bc6e75bee68c517c1326f3cf)
| | | | | | | | | | * | DO NOT MERGE SoundPool: add lock for findSample access from SoundPoolThreadAndy Hung2015-12-031-19/+42
| | | | | | | | | | |\ \ | | | | | | | | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 3d6a714980 * commit '3d6a7149802928ecf3f58b7218b0e82699b492df': DO NOT MERGE SoundPool: add lock for findSample access from SoundPoolThread
| | | | | | | | | | | * DO NOT MERGE SoundPool: add lock for findSample access from SoundPoolThreadAndy Hung2015-12-031-19/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sample decoding still occurs in SoundPoolThread without holding the SoundPool lock. Bug: 25781119 Change-Id: I11fde005aa9cf5438e0390a0d2dfe0ec1dd282e8
| | | | | | | | | | * | DO NOT MERGE - libstagefright: check requested memory size before allocation ↵Wei Jia2015-12-032-1/+18
| | | | | | | | | | |\ \ | | | | | | | | | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for SoftMPEG4Encoder and SoftVPXEncoder. am: 6afc659b00 * commit '6afc659b00c3f4a83b9f5f3c744b7119b33340b4': DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.
generated by cgit v1.1 at 2024-05-14 07:34:07 +0000