Piteball
/
android_hardware_qcom_media
mirror of https://github.com/followmsi/android_hardware_qcom_media.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

mm-video-v4l2: Squash below changes 

mm-video-v4l2: Protect buffer access and increase input buffer size

Protect buffer access for below scenarios:
*Increase the scope of buf_lock in free_buffer to avoid access
 of freed buffer for both input and output buffers. Also, add check
 before output buffer access.
*Disallow allocate buffer mode after client has called use buffer.
Allocate additional 512 bytes of memory for input buffers on top of
allocation size as per hardware requirement.

mm-video-v4l2: correct the buffer error flag setting

The buffer error flag setting is corrected in free_buffer()
call

Bug: 64340487
Test: poc from bug
Change-Id: I8a28d86135f2fc39a45a6a07355845327dec2dfa
Merged-In: I32d6cb7f61b873edd567881d1bf3e620cd78e715
(cherry picked from commit 808b94b164)
This commit is contained in:
Ray Essick 2018-06-29 14:12:19 -07:00 committed by android-build-team Robot
parent 3f70e6c487
commit 34572dcbf4
2 changed files with 27 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
msm8998/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
View File

@ -1,5 +1,5 @@
/*--------------------------------------------------------------------------
Copyright (c) 2010 - 2017, The Linux Foundation. All rights reserved.
Copyright (c) 2010 - 2018, The Linux Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
@ -1286,6 +1286,7 @@ class omx_vdec: public qc_omx_component
// list of extensions is not mutable after initialization
const VendorExtensionStore mVendorExtensionStore;
bool m_buffer_error;
};
#ifdef _MSM8974_

30
msm8998/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp
View File

@ -667,7 +667,8 @@ omx_vdec::omx_vdec(): m_error_propogated(false),
current_perf_level(V4L2_CID_MPEG_VIDC_PERF_LEVEL_NOMINAL),
secure_scaling_to_non_secure_opb(false),
m_force_compressed_for_dpb(true),
m_is_display_session(false)
m_is_display_session(false),
m_buffer_error(false)
{
m_pipe_in = -1;
m_pipe_out = -1;
@ -5995,6 +5996,7 @@ OMX_ERRORTYPE omx_vdec::use_output_buffer(
eRet = allocate_output_headers();
if (eRet == OMX_ErrorNone)
eRet = allocate_extradata();
output_use_buffer = true;
}
if (eRet == OMX_ErrorNone) {
@ -6504,7 +6506,6 @@ OMX_ERRORTYPE omx_vdec::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr)
index = bufferHdr - m_inp_mem_ptr;
DEBUG_PRINT_LOW("Free Input Buffer index = %d",index);
auto_lock l(buf_lock);
bufferHdr->pInputPortPrivate = NULL;
if (index < drv_ctx.ip_buf.actualcount && drv_ctx.ptr_inputbuffer) {
@ -6730,6 +6731,7 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer(
unsigned i = 0;
unsigned char *buf_addr = NULL;
int pmem_fd = -1;
unsigned int align_size = 0;
(void) hComp;
(void) port;
@ -6789,8 +6791,10 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer(
int rc;
DEBUG_PRINT_LOW("Allocate input Buffer");
#ifdef USE_ION
align_size = drv_ctx.ip_buf.buffer_size + 512;
align_size = (align_size + drv_ctx.ip_buf.alignment - 1)&(~(drv_ctx.ip_buf.alignment - 1));
drv_ctx.ip_buf_ion_info[i].ion_device_fd = alloc_map_ion_memory(
drv_ctx.ip_buf.buffer_size,drv_ctx.op_buf.alignment,
align_size, drv_ctx.op_buf.alignment,
&drv_ctx.ip_buf_ion_info[i].ion_alloc_data,
&drv_ctx.ip_buf_ion_info[i].fd_ion_data, secure_mode ?
SECURE_FLAGS_INPUT_BUFFER : 0);
@ -7346,6 +7350,10 @@ OMX_ERRORTYPE omx_vdec::allocate_buffer(OMX_IN OMX_HANDLETYPE hC
eRet = allocate_input_buffer(hComp,bufferHdr,port,appData,bytes);
}
} else if (port == OMX_CORE_OUTPUT_PORT_INDEX) {
if (output_use_buffer) {
DEBUG_PRINT_ERROR("Allocate output buffer not allowed after use buffer");
return OMX_ErrorBadParameter;
}
eRet = client_buffers.allocate_buffers_color_convert(hComp,bufferHdr,port,
appData,bytes);
} else {
@ -7406,6 +7414,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
(void) hComp;
DEBUG_PRINT_LOW("In for decoder free_buffer");
auto_lock l(buf_lock);
if (m_state == OMX_StateIdle &&
(BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) {
DEBUG_PRINT_LOW(" free buffer while Component in Loading pending");
@ -7422,7 +7431,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
post_event(OMX_EventError,
OMX_ErrorPortUnpopulated,
OMX_COMPONENT_GENERATE_EVENT);
m_buffer_error = true;
return OMX_ErrorIncorrectStateOperation;
} else if (m_state != OMX_StateInvalid) {
DEBUG_PRINT_ERROR("Invalid state to free buffer,port lost Buffers");
@ -7543,6 +7552,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
BITMASK_CLEAR((&m_flags),OMX_COMPONENT_LOADING_PENDING);
post_event(OMX_CommandStateSet, OMX_StateLoaded,
OMX_COMPONENT_GENERATE_EVENT);
m_buffer_error = false;
}
}
return eRet;
@ -7714,6 +7724,11 @@ OMX_ERRORTYPE omx_vdec::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp,
if (!temp_buffer || (temp_buffer - drv_ctx.ptr_inputbuffer) > (int)drv_ctx.ip_buf.actualcount) {
return OMX_ErrorBadParameter;
}
if (BITMASK_ABSENT(&m_inp_bm_count, nPortIndex) || m_buffer_error) {
DEBUG_PRINT_ERROR("ETBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex);
return OMX_ErrorBadParameter;
}
/* If its first frame, H264 codec and reject is true, then parse the nal
and get the profile. Based on this, reject the clip playback */
if (first_frame == 0 && codec_type_parse == CODEC_TYPE_H264 &&
@ -8015,6 +8030,7 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy(
struct vdec_bufferpayload *ptr_outputbuffer = NULL;
struct vdec_output_frameinfo *ptr_respbuffer = NULL;
auto_lock l(buf_lock);
nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr());
if (bufferAdd == NULL || nPortIndex >= drv_ctx.op_buf.actualcount) {
@ -8023,6 +8039,10 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy(
return OMX_ErrorBadParameter;
}
if (BITMASK_ABSENT(&m_out_bm_count, nPortIndex) || m_buffer_error) {
DEBUG_PRINT_ERROR("FTBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex);
return OMX_ErrorBadParameter;
}
DEBUG_PRINT_LOW("FTBProxy: bufhdr = %p, bufhdr->pBuffer = %p",
bufferAdd, bufferAdd->pBuffer);
/*Return back the output buffer to client*/
@ -9412,7 +9432,7 @@ int omx_vdec::async_message_process (void *context, void* message)
if (omxhdr && omxhdr->nFilledLen && !omx->m_need_turbo) {
omx->request_perf_level(VIDC_NOMINAL);
}
if (omx->output_use_buffer && omxhdr->pBuffer &&
if (!omx->m_enable_android_native_buffers && omx->output_use_buffer && omxhdr->pBuffer &&
vdec_msg->msgdata.output_frame.bufferaddr)
memcpy ( omxhdr->pBuffer, (void *)
((unsigned long)vdec_msg->msgdata.output_frame.bufferaddr +