Piteball/android_hardware_qcom_media
1
0
Fork 0
mirror of https://github.com/followmsi/android_hardware_qcom_media.git synced 2024-10-31 22:47:35 +00:00
Code Issues Projects Releases Packages Wiki Activity

mm-video-v4l2: venc: Protect buffer from being freed while accessing

Browse source 
am: a569853311

Change-Id: I773fff29d52e867cb34e5c0f8ef0d83cd25f6e3c
This commit is contained in:
Santhosh Behara 2017-10-10 21:42:35 +00:00 committed by android-build-merger
commit 2fcd17bd3a
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
msm8996/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
View file

@ -1,5 +1,5 @@
/*-------------------------------------------------------------------------- /*--------------------------------------------------------------------------
Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are modification, are permitted provided that the following conditions are
@ -655,6 +655,7 @@ class omx_video: public qc_omx_component
omx_cmd_queue m_opq_meta_q; omx_cmd_queue m_opq_meta_q;
omx_cmd_queue m_opq_pmem_q; omx_cmd_queue m_opq_pmem_q;
OMX_BUFFERHEADERTYPE meta_buffer_hdr[MAX_NUM_INPUT_BUFFERS]; OMX_BUFFERHEADERTYPE meta_buffer_hdr[MAX_NUM_INPUT_BUFFERS];
pthread_mutex_t m_buf_lock;
bool input_flush_progress; bool input_flush_progress;
bool output_flush_progress; bool output_flush_progress;

8
msm8996/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
View file

@ -1,5 +1,5 @@
/*-------------------------------------------------------------------------- /*--------------------------------------------------------------------------
Copyright (c) 2010-2016, Linux Foundation. All rights reserved. Copyright (c) 2010-2017, Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met: modification, are permitted provided that the following conditions are met:
@ -314,6 +314,8 @@ omx_video::omx_video():
pthread_mutex_init(&m_lock, NULL); pthread_mutex_init(&m_lock, NULL);
sem_init(&m_cmd_lock,0,0); sem_init(&m_cmd_lock,0,0);
DEBUG_PRINT_LOW("meta_buffer_hdr = %p", meta_buffer_hdr); DEBUG_PRINT_LOW("meta_buffer_hdr = %p", meta_buffer_hdr);
pthread_mutex_init(&m_buf_lock, NULL);
} }
@ -354,6 +356,8 @@ omx_video::~omx_video()
sem_destroy(&m_cmd_lock); sem_destroy(&m_cmd_lock);
DEBUG_PRINT_HIGH("m_etb_count = %" PRIu64 ", m_fbd_count = %" PRIu64, m_etb_count, DEBUG_PRINT_HIGH("m_etb_count = %" PRIu64 ", m_fbd_count = %" PRIu64, m_etb_count,
m_fbd_count); m_fbd_count);
pthread_mutex_destroy(&m_buf_lock);
DEBUG_PRINT_HIGH("omx_video: Destructor exit"); DEBUG_PRINT_HIGH("omx_video: Destructor exit");
DEBUG_PRINT_HIGH("Exiting OMX Video Encoder ..."); DEBUG_PRINT_HIGH("Exiting OMX Video Encoder ...");
} }
@ -2654,6 +2658,7 @@ OMX_ERRORTYPE omx_video::use_output_buffer(
return OMX_ErrorBadParameter; return OMX_ErrorBadParameter;
} }
auto_lock l(m_buf_lock);
if (!m_out_mem_ptr) { if (!m_out_mem_ptr) {
output_use_buffer = true; output_use_buffer = true;
int nBufHdrSize = 0; int nBufHdrSize = 0;
@ -3572,6 +3577,7 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual); nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual);
if (nPortIndex < m_sOutPortDef.nBufferCountActual && if (nPortIndex < m_sOutPortDef.nBufferCountActual &&
BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) { BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) {
auto_lock l(m_buf_lock);
// Clear the bit associated with it. // Clear the bit associated with it.
BITMASK_CLEAR(&m_out_bm_count,nPortIndex); BITMASK_CLEAR(&m_out_bm_count,nPortIndex);
m_sOutPortDef.bPopulated = OMX_FALSE; m_sOutPortDef.bPopulated = OMX_FALSE;

12
msm8996/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
View file

@ -2485,11 +2485,18 @@ int omx_venc::async_message_process (void *context, void* message)
OMX_COMPONENT_GENERATE_EBD); OMX_COMPONENT_GENERATE_EBD);
break; break;
case VEN_MSG_OUTPUT_BUFFER_DONE: case VEN_MSG_OUTPUT_BUFFER_DONE:
{
omxhdr = (OMX_BUFFERHEADERTYPE*)m_sVenc_msg->buf.clientdata; omxhdr = (OMX_BUFFERHEADERTYPE*)m_sVenc_msg->buf.clientdata;
OMX_U32 bufIndex = (OMX_U32)(omxhdr - omx->m_out_mem_ptr);
if ( (omxhdr != NULL) && if ( (omxhdr != NULL) &&
((OMX_U32)(omxhdr - omx->m_out_mem_ptr) < omx->m_sOutPortDef.nBufferCountActual)) { (bufIndex < omx->m_sOutPortDef.nBufferCountActual)) {
if (m_sVenc_msg->buf.len <= omxhdr->nAllocLen) { auto_lock l(omx->m_buf_lock);
if (BITMASK_ABSENT(&(omx->m_out_bm_count), bufIndex)) {
DEBUG_PRINT_ERROR("Recieved FBD for buffer that is already freed !");
break;
}
if (!omx->is_secure_session() && (m_sVenc_msg->buf.len <= omxhdr->nAllocLen)) {
omxhdr->nFilledLen = m_sVenc_msg->buf.len; omxhdr->nFilledLen = m_sVenc_msg->buf.len;
omxhdr->nOffset = m_sVenc_msg->buf.offset; omxhdr->nOffset = m_sVenc_msg->buf.offset;
omxhdr->nTimeStamp = m_sVenc_msg->buf.timestamp; omxhdr->nTimeStamp = m_sVenc_msg->buf.timestamp;
@ -2514,6 +2521,7 @@ int omx_venc::async_message_process (void *context, void* message)
omx->post_event ((unsigned long)omxhdr,m_sVenc_msg->statuscode, omx->post_event ((unsigned long)omxhdr,m_sVenc_msg->statuscode,
OMX_COMPONENT_GENERATE_FBD); OMX_COMPONENT_GENERATE_FBD);
break; break;
}
case VEN_MSG_NEED_OUTPUT_BUFFER: case VEN_MSG_NEED_OUTPUT_BUFFER:
//TBD what action needs to be done here?? //TBD what action needs to be done here??
break; break;