commit c06bd330d44c1c3e685aac289ada1413c3e166ef
author Andy Hung <hunga@google.com> Mon Apr 16 17:31:20 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Apr 16 17:31:20 2018 +0000
tree 1fc292d2e05aea4fb931f7bd810977926427b612
parent 40091487e4ffb23c50c7331d8183b86fd968b3a5
parent 498bdcc90bc470a79bf8943cbac64502f7c1c091

Merge "Sanitize effect descriptors for AudioPolicyService binder calls." into oc-dev

media/libstagefright/include/OMXNodeInstance.h

diff --git a/media/libstagefright/include/OMXNodeInstance.h b/media/libstagefright/include/OMXNodeInstance.h
index 00c37e1..0181794 100644
--- a/media/libstagefright/include/OMXNodeInstance.h
+++ b/media/libstagefright/include/OMXNodeInstance.h
@@ -107,6 +107,11 @@
 
     static OMX_CALLBACKTYPE kCallbacks;
 
+    enum SecureBufferType {
+        kSecureBufferTypeUnknown,
+        kSecureBufferTypeOpaque,
+        kSecureBufferTypeNativeHandle,
+    };
 private:
     struct CallbackDispatcherThread;
     struct CallbackDispatcher;
@@ -145,11 +150,6 @@
     IOMX::PortMode mPortMode[2];
     // metadata and secure buffer types and graphic buffer mode tracking
     MetadataBufferType mMetadataType[2];
-    enum SecureBufferType {
-        kSecureBufferTypeUnknown,
-        kSecureBufferTypeOpaque,
-        kSecureBufferTypeNativeHandle,
-    };
     SecureBufferType mSecureBufferType[2];
     bool mGraphicBufferEnabled[2];
 

media/libstagefright/omx/OMXNodeInstance.cpp

diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 34ecb22..cb99fb0 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -131,22 +131,34 @@
                 static_cast<void*>(mHidlMemory->getPointer())) : nullptr;
     }
 
-    void CopyFromOMX(const OMX_BUFFERHEADERTYPE *header) {
+    void CopyFromOMX(const OMX_BUFFERHEADERTYPE *header, OMXNodeInstance::SecureBufferType type) {
         if (!mCopyFromOmx) {
             return;
         }
 
+        if (type != OMXNodeInstance::kSecureBufferTypeUnknown) {
+            ALOGE("b/77486542");
+            android_errorWriteLog(0x534e4554, "77486542");
+            return;
+        }
+
         // check component returns proper range
         sp<ABuffer> codec = getBuffer(header, true /* limit */);
 
         memcpy(getPointer() + header->nOffset, codec->data(), codec->size());
     }
 
-    void CopyToOMX(const OMX_BUFFERHEADERTYPE *header) {
+    void CopyToOMX(const OMX_BUFFERHEADERTYPE *header, OMXNodeInstance::SecureBufferType type) {
         if (!mCopyToOmx) {
             return;
         }
 
+        if (type != OMXNodeInstance::kSecureBufferTypeUnknown) {
+            ALOGE("b/77486542");
+            android_errorWriteLog(0x534e4554, "77486542");
+            return;
+        }
+
         memcpy(header->pBuffer + header->nOffset,
                 getPointer() + header->nOffset,
                 header->nFilledLen);
@@ -1676,7 +1688,7 @@
         header->nFilledLen = rangeLength;
         header->nOffset = rangeOffset;
 
-        buffer_meta->CopyToOMX(header);
+        buffer_meta->CopyToOMX(header, mSecureBufferType[kPortIndexInput]);
     }
 
     return emptyBuffer_l(header, flags, timestamp, (intptr_t)buffer, fenceFd);
@@ -1964,7 +1976,7 @@
             CLOG_ERROR(onFillBufferDone, OMX_ErrorBadParameter,
                     FULL_BUFFER(NULL, buffer, msg.fenceFd));
         }
-        buffer_meta->CopyFromOMX(buffer);
+        buffer_meta->CopyFromOMX(buffer, mSecureBufferType[kPortIndexOutput]);
 
         // fix up the buffer info (especially timestamp) if needed
         codecBufferFilled(msg);