Piteball/android_hardware_qcom_media
1
0
Fork 0
mirror of https://github.com/followmsi/android_hardware_qcom_media.git synced 2024-10-31 22:47:35 +00:00
Code Issues Projects Releases Packages Wiki Activity

Snap for 4386596 from 38641613a6 to oc-mr1-release

Browse source 
Change-Id: I08b163a8f2a36c88b2af1bd26fb9c8690ec3f7f7
This commit is contained in:
android-build-team Robot 2017-10-10 07:24:19 +00:00
commit 45b97094d9
6 changed files with 66 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
msm8996/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
View file

@ -677,6 +677,8 @@ class omx_video: public qc_omx_component
int pending_output_buffers;
uint64_t m_out_bm_count;
uint64_t m_client_out_bm_count;
uint64_t m_client_in_bm_count;
uint64_t m_inp_bm_count;
uint64_t m_flags;
uint64_t m_etb_count;

35
msm8996/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
View file

@ -295,6 +295,8 @@ omx_video::omx_video():
pending_input_buffers(0),
pending_output_buffers(0),
m_out_bm_count(0),
m_client_out_bm_count(0),
m_client_in_bm_count(0),
m_inp_bm_count(0),
m_flags(0),
m_etb_count(0),
@ -2540,6 +2542,7 @@ OMX_ERRORTYPE omx_video::use_input_buffer(
*bufferHdr = (m_inp_mem_ptr + i);
BITMASK_SET(&m_inp_bm_count,i);
BITMASK_SET(&m_client_in_bm_count,i);
(*bufferHdr)->pBuffer = (OMX_U8 *)buffer;
(*bufferHdr)->nSize = sizeof(OMX_BUFFERHEADERTYPE);
@ -2668,7 +2671,6 @@ OMX_ERRORTYPE omx_video::use_output_buffer(
return OMX_ErrorBadParameter;
}
auto_lock l(m_buf_lock);
if (!m_out_mem_ptr) {
output_use_buffer = true;
int nBufHdrSize = 0;
@ -2819,6 +2821,7 @@ OMX_ERRORTYPE omx_video::use_output_buffer(
}
BITMASK_SET(&m_out_bm_count,i);
BITMASK_SET(&m_client_out_bm_count,i);
} else {
DEBUG_PRINT_ERROR("ERROR: All o/p Buffers have been Used, invalid use_buf call for "
"index = %u", i);
@ -2856,7 +2859,10 @@ OMX_ERRORTYPE omx_video::use_buffer(
DEBUG_PRINT_ERROR("ERROR: Use Buffer in Invalid State");
return OMX_ErrorInvalidState;
}
auto_lock l(m_buf_lock);
if (port == PORT_INDEX_IN) {
auto_lock l(m_lock);
eRet = use_input_buffer(hComp,bufferHdr,port,appData,bytes,buffer);
} else if (port == PORT_INDEX_OUT) {
eRet = use_output_buffer(hComp,bufferHdr,port,appData,bytes,buffer);
@ -2927,7 +2933,6 @@ OMX_ERRORTYPE omx_video::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr)
}
if (index < m_sInPortDef.nBufferCountActual && m_pInput_pmem) {
auto_lock l(m_lock);
if (mUseProxyColorFormat) {
if (m_opq_pmem_q.m_size) {
@ -3048,7 +3053,9 @@ OMX_ERRORTYPE omx_video::allocate_input_meta_buffer(
meta_buffer_hdr, m_inp_mem_ptr);
}
for (index = 0; ((index < m_sInPortDef.nBufferCountActual) &&
meta_buffer_hdr[index].pBuffer); index++);
meta_buffer_hdr[index].pBuffer &&
BITMASK_PRESENT(&m_inp_bm_count, index)); index++);
if (index == m_sInPortDef.nBufferCountActual) {
DEBUG_PRINT_ERROR("All buffers are allocated input_meta_buffer");
return OMX_ErrorBadParameter;
@ -3447,9 +3454,10 @@ OMX_ERRORTYPE omx_video::allocate_buffer(OMX_IN OMX_HANDLETYPE h
DEBUG_PRINT_ERROR("ERROR: Allocate Buf in Invalid State");
return OMX_ErrorInvalidState;
}
auto_lock l(m_buf_lock);
// What if the client calls again.
if (port == PORT_INDEX_IN) {
auto_lock l(m_lock);
#ifdef _ANDROID_ICS_
if (meta_mode_enable)
eRet = allocate_input_meta_buffer(hComp,bufferHdr,appData,bytes);
@ -3518,7 +3526,16 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
unsigned int nPortIndex;
DEBUG_PRINT_LOW("In for encoder free_buffer");
auto_lock l(m_buf_lock);
if (port == PORT_INDEX_OUT) { //client called freebuffer, clearing client buffer bitmask right away to avoid use after free
nPortIndex = buffer - (OMX_BUFFERHEADERTYPE*)m_out_mem_ptr;
if(BITMASK_PRESENT(&m_client_out_bm_count, nPortIndex))
BITMASK_CLEAR(&m_client_out_bm_count,nPortIndex);
} else if (port == PORT_INDEX_IN) {
nPortIndex = buffer - (meta_mode_enable?meta_buffer_hdr:m_inp_mem_ptr);
if(BITMASK_PRESENT(&m_client_in_bm_count, nPortIndex))
BITMASK_CLEAR(&m_client_in_bm_count,nPortIndex);
}
if (m_state == OMX_StateIdle &&
(BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) {
DEBUG_PRINT_LOW(" free buffer while Component in Loading pending");
@ -3544,10 +3561,12 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
DEBUG_PRINT_LOW("free_buffer on i/p port - Port idx %u, actual cnt %u",
nPortIndex, (unsigned int)m_sInPortDef.nBufferCountActual);
pthread_mutex_lock(&m_lock);
if (nPortIndex < m_sInPortDef.nBufferCountActual &&
BITMASK_PRESENT(&m_inp_bm_count, nPortIndex)) {
// Clear the bit associated with it.
BITMASK_CLEAR(&m_inp_bm_count,nPortIndex);
pthread_mutex_unlock(&m_lock);
free_input_buffer (buffer);
m_sInPortDef.bPopulated = OMX_FALSE;
@ -3575,6 +3594,7 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
#endif
}
} else {
pthread_mutex_unlock(&m_lock);
DEBUG_PRINT_ERROR("ERROR: free_buffer ,Port Index Invalid");
eRet = OMX_ErrorBadPortIndex;
}
@ -3595,7 +3615,6 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual);
if (nPortIndex < m_sOutPortDef.nBufferCountActual &&
BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) {
auto_lock l(m_buf_lock);
// Clear the bit associated with it.
BITMASK_CLEAR(&m_out_bm_count,nPortIndex);
m_sOutPortDef.bPopulated = OMX_FALSE;
@ -3856,9 +3875,9 @@ OMX_ERRORTYPE omx_video::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp,
{
DEBUG_PRINT_LOW("Heap UseBuffer case, so memcpy the data");
auto_lock l(m_lock);
auto_lock l(m_buf_lock);
pmem_data_buf = (OMX_U8 *)m_pInput_pmem[nBufIndex].buffer;
if (pmem_data_buf) {
if (pmem_data_buf && BITMASK_PRESENT(&m_client_in_bm_count, nBufIndex)) {
memcpy (pmem_data_buf, (buffer->pBuffer + buffer->nOffset),
buffer->nFilledLen);
}

9
msm8996/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
View file

@ -2190,11 +2190,15 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp)
DEBUG_PRINT_ERROR("WARNING:Rxd DeInit,OMX not in LOADED state %d",\
m_state);
}
auto_lock l(m_buf_lock);
if (m_out_mem_ptr) {
DEBUG_PRINT_LOW("Freeing the Output Memory");
for (i=0; i< m_sOutPortDef.nBufferCountActual; i++ ) {
if (BITMASK_PRESENT(&m_out_bm_count, i)) {
BITMASK_CLEAR(&m_out_bm_count, i);
if (BITMASK_PRESENT(&m_client_out_bm_count, i))
BITMASK_CLEAR(&m_client_out_bm_count, i);
free_output_buffer (&m_out_mem_ptr[i]);
}
@ -2216,6 +2220,8 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp)
for (i=0; i<m_sInPortDef.nBufferCountActual; i++ ) {
if (BITMASK_PRESENT(&m_inp_bm_count, i)) {
BITMASK_CLEAR(&m_inp_bm_count, i);
if (BITMASK_PRESENT(&m_client_in_bm_count, i))
BITMASK_CLEAR(&m_client_in_bm_count, i);
free_input_buffer (&m_inp_mem_ptr[i]);
}
@ -2546,7 +2552,8 @@ int omx_venc::async_message_process (void *context, void* message)
omxhdr->nFlags = m_sVenc_msg->buf.flags;
/*Use buffer case*/
if (omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
if (BITMASK_PRESENT(&(omx->m_client_out_bm_count), bufIndex) &&
omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
DEBUG_PRINT_LOW("memcpy() for o/p Heap UseBuffer");
memcpy(omxhdr->pBuffer,
(m_sVenc_msg->buf.ptrbuffer),

2
msm8998/mm-video-v4l2/vidc/venc/inc/omx_video_base.h
View file

@ -702,6 +702,8 @@ class omx_video: public qc_omx_component
bool allocate_native_handle;
uint64_t m_out_bm_count;
uint64_t m_client_out_bm_count;
uint64_t m_client_in_bm_count;
uint64_t m_inp_bm_count;
uint64_t m_flags;
uint64_t m_etb_count;

27
msm8998/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp
View file

@ -289,6 +289,8 @@ omx_video::omx_video():
pending_output_buffers(0),
allocate_native_handle(false),
m_out_bm_count(0),
m_client_out_bm_count(0),
m_client_in_bm_count(0),
m_inp_bm_count(0),
m_flags(0),
m_etb_count(0),
@ -2623,6 +2625,7 @@ OMX_ERRORTYPE omx_video::use_input_buffer(
*bufferHdr = (m_inp_mem_ptr + i);
BITMASK_SET(&m_inp_bm_count,i);
BITMASK_SET(&m_client_in_bm_count,i);
(*bufferHdr)->pBuffer = (OMX_U8 *)buffer;
(*bufferHdr)->nSize = sizeof(OMX_BUFFERHEADERTYPE);
@ -2751,7 +2754,6 @@ OMX_ERRORTYPE omx_video::use_output_buffer(
return OMX_ErrorBadParameter;
}
auto_lock l(m_buf_lock);
if (!m_out_mem_ptr) {
output_use_buffer = true;
int nBufHdrSize = 0;
@ -2902,6 +2904,7 @@ OMX_ERRORTYPE omx_video::use_output_buffer(
}
BITMASK_SET(&m_out_bm_count,i);
BITMASK_SET(&m_client_out_bm_count,i);
} else {
DEBUG_PRINT_ERROR("ERROR: All o/p Buffers have been Used, invalid use_buf call for "
"index = %u", i);
@ -2939,6 +2942,8 @@ OMX_ERRORTYPE omx_video::use_buffer(
DEBUG_PRINT_ERROR("ERROR: Use Buffer in Invalid State");
return OMX_ErrorInvalidState;
}
auto_lock l(m_buf_lock);
if (port == PORT_INDEX_IN) {
auto_lock l(m_lock);
eRet = use_input_buffer(hComp,bufferHdr,port,appData,bytes,buffer);
@ -2948,7 +2953,6 @@ OMX_ERRORTYPE omx_video::use_buffer(
DEBUG_PRINT_ERROR("ERROR: Invalid Port Index received %d",(int)port);
eRet = OMX_ErrorBadPortIndex;
}
if (eRet == OMX_ErrorNone) {
if (allocate_done()) {
if (BITMASK_PRESENT(&m_flags,OMX_COMPONENT_IDLE_PENDING)) {
@ -3011,7 +3015,6 @@ OMX_ERRORTYPE omx_video::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr)
}
if (index < m_sInPortDef.nBufferCountActual && m_pInput_pmem) {
auto_lock l(m_lock);
if (mUseProxyColorFormat) {
if (m_opq_pmem_q.m_size) {
@ -3565,7 +3568,7 @@ OMX_ERRORTYPE omx_video::allocate_buffer(OMX_IN OMX_HANDLETYPE h
DEBUG_PRINT_ERROR("ERROR: Allocate Buf in Invalid State");
return OMX_ErrorInvalidState;
}
auto_lock l(m_buf_lock);
// What if the client calls again.
if (port == PORT_INDEX_IN) {
auto_lock l(m_lock);
@ -3637,7 +3640,16 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
unsigned int nPortIndex;
DEBUG_PRINT_LOW("In for encoder free_buffer");
auto_lock l(m_buf_lock);
if (port == PORT_INDEX_OUT) { //client called freebuffer, clearing client buffer bitmask right away to avoid use after free
nPortIndex = buffer - (OMX_BUFFERHEADERTYPE*)m_out_mem_ptr;
if(BITMASK_PRESENT(&m_client_out_bm_count, nPortIndex))
BITMASK_CLEAR(&m_client_out_bm_count,nPortIndex);
} else if (port == PORT_INDEX_IN) {
nPortIndex = buffer - (meta_mode_enable?meta_buffer_hdr:m_inp_mem_ptr);
if(BITMASK_PRESENT(&m_client_in_bm_count, nPortIndex))
BITMASK_CLEAR(&m_client_in_bm_count,nPortIndex);
}
if (m_state == OMX_StateIdle &&
(BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) {
DEBUG_PRINT_LOW(" free buffer while Component in Loading pending");
@ -3717,7 +3729,6 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp,
nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual);
if (nPortIndex < m_sOutPortDef.nBufferCountActual &&
BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) {
auto_lock l(m_buf_lock);
// Clear the bit associated with it.
BITMASK_CLEAR(&m_out_bm_count,nPortIndex);
m_sOutPortDef.bPopulated = OMX_FALSE;
@ -3997,9 +4008,9 @@ OMX_ERRORTYPE omx_video::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp,
{
DEBUG_PRINT_LOW("Heap UseBuffer case, so memcpy the data");
auto_lock l(m_lock);
auto_lock l(m_buf_lock);
pmem_data_buf = (OMX_U8 *)m_pInput_pmem[nBufIndex].buffer;
if (pmem_data_buf && BITMASK_PRESENT(&m_inp_bm_count, nBufIndex)) {
if (pmem_data_buf && BITMASK_PRESENT(&m_client_in_bm_count, nBufIndex)) {
memcpy (pmem_data_buf, (buffer->pBuffer + buffer->nOffset),
buffer->nFilledLen);
}

9
msm8998/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp
View file

@ -2361,11 +2361,15 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp)
DEBUG_PRINT_ERROR("WARNING:Rxd DeInit,OMX not in LOADED state %d",\
m_state);
}
auto_lock l(m_buf_lock);
if (m_out_mem_ptr) {
DEBUG_PRINT_LOW("Freeing the Output Memory");
for (i=0; i< m_sOutPortDef.nBufferCountActual; i++ ) {
if (BITMASK_PRESENT(&m_out_bm_count, i)) {
BITMASK_CLEAR(&m_out_bm_count, i);
if (BITMASK_PRESENT(&m_client_out_bm_count, i))
BITMASK_CLEAR(&m_client_out_bm_count, i);
free_output_buffer (&m_out_mem_ptr[i]);
}
@ -2387,6 +2391,8 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp)
for (i=0; i<m_sInPortDef.nBufferCountActual; i++ ) {
if (BITMASK_PRESENT(&m_inp_bm_count, i)) {
BITMASK_CLEAR(&m_inp_bm_count, i);
if (BITMASK_PRESENT(&m_client_in_bm_count, i))
BITMASK_CLEAR(&m_client_in_bm_count, i);
free_input_buffer (&m_inp_mem_ptr[i]);
}
@ -2725,7 +2731,8 @@ int omx_venc::async_message_process (void *context, void* message)
omxhdr->nFlags = m_sVenc_msg->buf.flags;
/*Use buffer case*/
if (omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
if (BITMASK_PRESENT(&(omx->m_client_out_bm_count), bufIndex) &&
omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) {
DEBUG_PRINT_LOW("memcpy() for o/p Heap UseBuffer");
memcpy(omxhdr->pBuffer,
(m_sVenc_msg->buf.ptrbuffer),