Merge "MediaPlayer: use mLock to prevent racing condition." into nyc-dev
am: 2c96c0e
* commit '2c96c0e35c7600c1112baa2cbebdf52f477c8880':
MediaPlayer: use mLock to prevent racing condition.
diff --git a/camera/tests/Android.mk b/camera/tests/Android.mk
index 8019999..0978a81 100644
--- a/camera/tests/Android.mk
+++ b/camera/tests/Android.mk
@@ -21,6 +21,7 @@
CameraBinderTests.cpp
LOCAL_SHARED_LIBRARIES := \
+ liblog \
libutils \
libcutils \
libcamera_metadata \
diff --git a/media/img_utils/src/Android.mk b/media/img_utils/src/Android.mk
index 4074849..c1f64ca 100644
--- a/media/img_utils/src/Android.mk
+++ b/media/img_utils/src/Android.mk
@@ -34,6 +34,7 @@
StripSource.cpp \
LOCAL_SHARED_LIBRARIES := \
+ liblog \
libexpat \
libutils \
libcutils \
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
index 13716cf..978d360 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
@@ -256,6 +256,12 @@
payload_size += last_byte;
} while (last_byte == 0xFF);
+ if (payload_size > SIZE_MAX / 8
+ || !br.atLeastNumBitsLeft(payload_size * 8)) {
+ ALOGV("Malformed SEI payload");
+ break;
+ }
+
// sei_payload()
if (payload_type == 4) {
bool isCC = false;
diff --git a/media/libstagefright/DataURISource.cpp b/media/libstagefright/DataURISource.cpp
index 2a61c3a..3dc345f 100644
--- a/media/libstagefright/DataURISource.cpp
+++ b/media/libstagefright/DataURISource.cpp
@@ -28,7 +28,7 @@
return NULL;
}
- char *commaPos = strrchr(uri, ',');
+ const char *commaPos = strrchr(uri, ',');
if (commaPos == NULL) {
return NULL;
diff --git a/media/libstagefright/MediaCodecList.cpp b/media/libstagefright/MediaCodecList.cpp
index 0fb5072..08bb45d 100644
--- a/media/libstagefright/MediaCodecList.cpp
+++ b/media/libstagefright/MediaCodecList.cpp
@@ -182,7 +182,7 @@
void MediaCodecList::parseTopLevelXMLFile(const char *codecs_xml, bool ignore_errors) {
// get href_base
- char *href_base_end = strrchr(codecs_xml, '/');
+ const char *href_base_end = strrchr(codecs_xml, '/');
if (href_base_end != NULL) {
mHrefBase = AString(codecs_xml, href_base_end - codecs_xml + 1);
}
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index 1bdd812..734e14e 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -209,6 +209,11 @@
status_t SampleTable::setSampleToChunkParams(
off64_t data_offset, size_t data_size) {
if (mSampleToChunkOffset >= 0) {
+ // already set
+ return ERROR_MALFORMED;
+ }
+
+ if (data_offset < 0) {
return ERROR_MALFORMED;
}
@@ -246,7 +251,7 @@
for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) {
uint8_t buffer[12];
- if ((off64_t)(SIZE_MAX - 8 - (i * 12)) < mSampleToChunkOffset) {
+ if ((SIZE_MAX - 8 - (i * 12)) < (size_t)mSampleToChunkOffset) {
return ERROR_MALFORMED;
}
diff --git a/media/libstagefright/foundation/ADebug.cpp b/media/libstagefright/foundation/ADebug.cpp
index 2c5f544..1a5b2a3 100644
--- a/media/libstagefright/foundation/ADebug.cpp
+++ b/media/libstagefright/foundation/ADebug.cpp
@@ -49,7 +49,7 @@
++current;
}
// check for :
- char *colon = strchr(current, ':');
+ const char *colon = strchr(current, ':');
// get level
char *end;
diff --git a/media/libstagefright/httplive/Android.mk b/media/libstagefright/httplive/Android.mk
index f904212..2c985fc 100644
--- a/media/libstagefright/httplive/Android.mk
+++ b/media/libstagefright/httplive/Android.mk
@@ -18,6 +18,7 @@
LOCAL_SANITIZE := unsigned-integer-overflow signed-integer-overflow
LOCAL_SHARED_LIBRARIES := \
+ liblog \
libbinder \
libcrypto \
libcutils \
diff --git a/media/libstagefright/httplive/M3UParser.cpp b/media/libstagefright/httplive/M3UParser.cpp
index ff2bb27..4969b2a 100644
--- a/media/libstagefright/httplive/M3UParser.cpp
+++ b/media/libstagefright/httplive/M3UParser.cpp
@@ -498,8 +498,8 @@
if (url[0] == '/') {
// URL is an absolute path.
- char *protocolEnd = strstr(baseURL, "//") + 2;
- char *pathStart = strchr(protocolEnd, '/');
+ const char *protocolEnd = strstr(baseURL, "//") + 2;
+ const char *pathStart = strchr(protocolEnd, '/');
if (pathStart != NULL) {
out->setTo(baseURL, pathStart - baseURL);
diff --git a/media/libstagefright/include/avc_utils.h b/media/libstagefright/include/avc_utils.h
index dafa07e..26afd73 100644
--- a/media/libstagefright/include/avc_utils.h
+++ b/media/libstagefright/include/avc_utils.h
@@ -37,8 +37,8 @@
};
struct NALPosition {
- size_t nalOffset;
- size_t nalSize;
+ uint32_t nalOffset;
+ uint32_t nalSize;
};
// Optionally returns sample aspect ratio as well.
diff --git a/media/libstagefright/wifi-display/source/WifiDisplaySource.cpp b/media/libstagefright/wifi-display/source/WifiDisplaySource.cpp
index e26165e..b43802d 100644
--- a/media/libstagefright/wifi-display/source/WifiDisplaySource.cpp
+++ b/media/libstagefright/wifi-display/source/WifiDisplaySource.cpp
@@ -782,7 +782,7 @@
return;
}
- char *commaPos = strchr(s, ',');
+ const char *commaPos = strchr(s, ',');
if (commaPos != NULL) {
s = commaPos + 1;
diff --git a/services/audioflinger/AudioFlinger.cpp b/services/audioflinger/AudioFlinger.cpp
index 016c25e..563c528 100644
--- a/services/audioflinger/AudioFlinger.cpp
+++ b/services/audioflinger/AudioFlinger.cpp
@@ -1364,11 +1364,15 @@
mAudioFlinger(audioFlinger),
mPid(pid)
{
- size_t heapSize = kClientSharedHeapSizeBytes;
- // Increase heap size on non low ram devices to limit risk of reconnection failure for
- // invalidated tracks
- if (!audioFlinger->isLowRamDevice()) {
- heapSize *= kClientSharedHeapSizeMultiplier;
+ size_t heapSize = property_get_int32("ro.af.client_heap_size_kbyte", 0);
+ heapSize *= 1024;
+ if (!heapSize) {
+ heapSize = kClientSharedHeapSizeBytes;
+ // Increase heap size on non low ram devices to limit risk of reconnection failure for
+ // invalidated tracks
+ if (!audioFlinger->isLowRamDevice()) {
+ heapSize *= kClientSharedHeapSizeMultiplier;
+ }
}
mMemoryDealer = new MemoryDealer(heapSize, "AudioFlinger::Client");
}
diff --git a/services/audiopolicy/enginedefault/Android.mk b/services/audiopolicy/enginedefault/Android.mk
index 85d1822..b247e21 100755
--- a/services/audiopolicy/enginedefault/Android.mk
+++ b/services/audiopolicy/enginedefault/Android.mk
@@ -40,6 +40,7 @@
libxml2
LOCAL_SHARED_LIBRARIES += \
+ liblog \
libcutils \
libutils \
libaudioutils \
diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index 0c88dad..fb71142 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -102,7 +102,7 @@
sp<CameraService> cs = const_cast<CameraService*>(
static_cast<const CameraService*>(callbacks));
- cs->onDeviceStatusChanged(static_cast<camera_device_status_t>(camera_id),
+ cs->onDeviceStatusChanged(camera_id,
static_cast<camera_device_status_t>(new_status));
}
@@ -271,12 +271,14 @@
}
sp<ICameraServiceProxy> CameraService::getCameraServiceProxy() {
+ sp<ICameraServiceProxy> proxyBinder = nullptr;
+#ifndef __BRILLO__
sp<IServiceManager> sm = defaultServiceManager();
sp<IBinder> binder = sm->getService(String16("media.camera.proxy"));
- if (binder == nullptr) {
- return nullptr;
+ if (binder != nullptr) {
+ proxyBinder = interface_cast<ICameraServiceProxy>(binder);
}
- sp<ICameraServiceProxy> proxyBinder = interface_cast<ICameraServiceProxy>(binder);
+#endif
return proxyBinder;
}
@@ -295,7 +297,7 @@
gCameraService = nullptr;
}
-void CameraService::onDeviceStatusChanged(camera_device_status_t cameraId,
+void CameraService::onDeviceStatusChanged(int cameraId,
camera_device_status_t newStatus) {
ALOGI("%s: Status changed for cameraId=%d, newStatus=%d", __FUNCTION__,
cameraId, newStatus);
@@ -915,6 +917,48 @@
const String8& clientName8, /*inout*/int& clientUid, /*inout*/int& clientPid,
/*out*/int& originalClientPid) const {
+#if !defined(__BRILLO__)
+ Status allowed = validateClientPermissionsLocked(cameraId, clientName8, clientUid, clientPid,
+ originalClientPid);
+ if (!allowed.isOk()) {
+ return allowed;
+ }
+#endif // defined(__BRILLO__)
+
+ int callingPid = getCallingPid();
+
+ if (!mModule) {
+ ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
+ callingPid);
+ return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+ "No camera HAL module available to open camera device \"%s\"", cameraId.string());
+ }
+
+ if (getCameraState(cameraId) == nullptr) {
+ ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
+ cameraId.string());
+ return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+ "No camera device with ID \"%s\" available", cameraId.string());
+ }
+
+ status_t err = checkIfDeviceIsUsable(cameraId);
+ if (err != NO_ERROR) {
+ switch(err) {
+ case -ENODEV:
+ case -EBUSY:
+ return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+ "No camera device with ID \"%s\" currently available", cameraId.string());
+ default:
+ return STATUS_ERROR_FMT(ERROR_INVALID_OPERATION,
+ "Unknown error connecting to ID \"%s\"", cameraId.string());
+ }
+ }
+ return Status::ok();
+}
+
+Status CameraService::validateClientPermissionsLocked(const String8& cameraId,
+ const String8& clientName8, int& clientUid, int& clientPid,
+ /*out*/int& originalClientPid) const {
int callingPid = getCallingPid();
int callingUid = getCallingUid();
@@ -958,20 +1002,6 @@
originalClientPid = clientPid;
clientPid = callingPid;
- if (!mModule) {
- ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
- callingPid);
- return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
- "No camera HAL module available to open camera device \"%s\"", cameraId.string());
- }
-
- if (getCameraState(cameraId) == nullptr) {
- ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
- cameraId.string());
- return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
- "No camera device with ID \"%s\" available", cameraId.string());
- }
-
userid_t clientUserId = multiuser_get_user_id(clientUid);
// Only allow clients who are being used by the current foreground device user, unless calling
@@ -985,18 +1015,6 @@
clientUserId, cameraId.string());
}
- status_t err = checkIfDeviceIsUsable(cameraId);
- if (err != NO_ERROR) {
- switch(err) {
- case -ENODEV:
- case -EBUSY:
- return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
- "No camera device with ID \"%s\" currently available", cameraId.string());
- default:
- return STATUS_ERROR_FMT(ERROR_INVALID_OPERATION,
- "Unknown error connecting to ID \"%s\"", cameraId.string());
- }
- }
return Status::ok();
}
diff --git a/services/camera/libcameraservice/CameraService.h b/services/camera/libcameraservice/CameraService.h
index 11b1351..4332ce3 100644
--- a/services/camera/libcameraservice/CameraService.h
+++ b/services/camera/libcameraservice/CameraService.h
@@ -95,7 +95,7 @@
/////////////////////////////////////////////////////////////////////
// HAL Callbacks
- virtual void onDeviceStatusChanged(camera_device_status_t cameraId,
+ virtual void onDeviceStatusChanged(int cameraId,
camera_device_status_t newStatus);
virtual void onTorchStatusChanged(const String8& cameraId,
int32_t newStatus);
@@ -495,7 +495,9 @@
// mediaserver to connect to camera (using MediaRecorder to connect to camera). In that case,
// clientPid is the PID of mediaserver and originalClientPid is the PID of the application.
binder::Status validateConnectLocked(const String8& cameraId, const String8& clientName8,
- /*inout*/int& clientUid, /*inout*/int& clientPid, /*out*/int& originalClientPid) const;
+ /*inout*/int& clientUid, /*inout*/int& clientPid, /*out*/int& originalClientPid) const;
+ binder::Status validateClientPermissionsLocked(const String8& cameraId, const String8& clientName8,
+ /*inout*/int& clientUid, /*inout*/int& clientPid, /*out*/int& originalClientPid) const;
// Handle active client evictions, and update service state.
// Only call with with mServiceLock held.