From f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba Mon Sep 17 00:00:00 2001 From: Marco Nelissen Date: Wed, 16 Mar 2016 10:32:05 -0700 Subject: Add VPX output buffer size check and handle dead observers more gracefully Bug: 27597103 Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518 --- media/libstagefright/omx/OMX.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'media/libstagefright/omx/OMX.cpp') diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp index 7f357c9..56b6055 100644 --- a/media/libstagefright/omx/OMX.cpp +++ b/media/libstagefright/omx/OMX.cpp @@ -179,7 +179,12 @@ void OMX::binderDied(const wp &the_late_who) { Mutex::Autolock autoLock(mLock); ssize_t index = mLiveNodes.indexOfKey(the_late_who); - CHECK(index >= 0); + + if (index < 0) { + ALOGE("b/27597103, nonexistent observer on binderDied"); + android_errorWriteLog(0x534e4554, "27597103"); + return; + } instance = mLiveNodes.editValueAt(index); mLiveNodes.removeItemsAt(index); -- cgit v1.1 From bc8a45f506a8be33250c523d71fab637a5fdaf81 Mon Sep 17 00:00:00 2001 From: Lajos Molnar Date: Tue, 2 Aug 2016 07:07:05 -0700 Subject: IOMX: work against metadata buffer spoofing - Prohibit direct set/getParam/Settings for extensions meant for OMXNodeInstance alone. This disallows enabling metadata mode without the knowledge of OMXNodeInstance. - Do not share metadata mode buffers cross process. - Disallow setting up metadata mode/tunneling/input surface after first sendCommand. - Disallow store-meta for input cross process. - Disallow emptyBuffer for surface input (via IOMX). - Fix checking for input surface. Bug: 29422020 Change-Id: I801c77b80e703903f62e42d76fd2e76a34e4bc8e (cherry picked from commit f8a4cb410115045278f534e54b41ac78d6bf6c07) --- media/libstagefright/omx/OMX.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'media/libstagefright/omx/OMX.cpp') diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp index 56b6055..5898b4e 100644 --- a/media/libstagefright/omx/OMX.cpp +++ b/media/libstagefright/omx/OMX.cpp @@ -368,9 +368,9 @@ status_t OMX::configureVideoTunnelMode( status_t OMX::useBuffer( node_id node, OMX_U32 port_index, const sp ¶ms, - buffer_id *buffer, OMX_U32 allottedSize) { + buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess) { return findInstance(node)->useBuffer( - port_index, params, buffer, allottedSize); + port_index, params, buffer, allottedSize, crossProcess); } status_t OMX::useGraphicBuffer( @@ -421,9 +421,9 @@ status_t OMX::allocateBuffer( status_t OMX::allocateBufferWithBackup( node_id node, OMX_U32 port_index, const sp ¶ms, - buffer_id *buffer, OMX_U32 allottedSize) { + buffer_id *buffer, OMX_U32 allottedSize, OMX_BOOL crossProcess) { return findInstance(node)->allocateBufferWithBackup( - port_index, params, buffer, allottedSize); + port_index, params, buffer, allottedSize, crossProcess); } status_t OMX::freeBuffer(node_id node, OMX_U32 port_index, buffer_id buffer) { -- cgit v1.1