Merge cherrypicks of [4691111, 4689862, 4690575, 4690576, 4690577, 4690578, 4689866, 4689868, 4689869, 4689870, 4691132, 4689456, 4689963, 4691133, 4691134, 4691156, 4691157, 4691159, 4691161, 4690581, 4689964, 4689460, 4691112, 4690582, 4690583, 4691165, 4691166, 4691167, 4691168, 4691169, 4691170, 4691211, 4691212, 4691213, 4691214, 4691215, 4691216, 4691217, 4691218, 4691219, 4691232, 4691233, 4691234, 4691235, 4691236, 4691237, 4691238, 4691239, 4691240, 4691241, 4691243, 4691245, 4691247, 4691249, 4691250, 4691291, 4691292, 4691293, 4691294, 4691295, 4691296, 4691255, 4689476, 4689477, 4689478, 4691223, 4691224, 4691136, 4689479, 4689480, 4691137, 4691225, 4691226, 4691227, 4691371, 4691228, 4691328, 4689967, 4691138, 4691139, 4691140, 4691433, 4689968, 4689969, 4691395, 4691230, 4691297, 4691298, 4691299, 4691300, 4691396, 4691397, 4691398, 4691399, 4691400, 4691401, 4691402, 4691403, 4691404, 4691405, 4691406, 4691407, 4691408, 4691409, 4691410, 4691471, 4691472, 4691473, 4691474, 4691475, 4691476, 4691477, 4691478, 4691479, 4691480, 4691481, 4691482, 4691483, 4691484, 4691485, 4691486, 4691487, 4691488, 4691143, 4691144, 4691511, 4691113, 4689482, 4691533, 4691145, 4691146, 4691147, 4691148, 4691536] into sparse-4732991-L01200000196794104android-8.1.0_r67android-8.1.0_r65android-8.1.0_r64android-8.1.0_r63android-8.1.0_r62android-8.1.0_r61android-8.1.0_r60android-8.1.0_r53android-8.1.0_r51android-8.1.0_r48android-8.1.0_r45oreo-m8-releaseoreo-m4-s12-release

Change-Id: I55024d2edcf7a4c1d8900bfd8b9eb3e83ef2827b

4 files changed, 80 insertions, 58 deletions

diff --git a/cas/1.0/default/CasImpl.cpp b/cas/1.0/default/CasImpl.cpp
index 9d1f4a3268..178020e477 100644
--- a/cas/1.0/default/CasImpl.cpp
+++ b/cas/1.0/default/CasImpl.cpp
@@ -31,19 +31,8 @@ namespace cas {
 namespace V1_0 {
 namespace implementation {
 
-struct CasImpl::PluginHolder : public RefBase {
-public:
-    explicit PluginHolder(CasPlugin *plugin) : mPlugin(plugin) {}
-    ~PluginHolder() { if (mPlugin != NULL) delete mPlugin; }
-    CasPlugin* get() { return mPlugin; }
-
-private:
-    CasPlugin *mPlugin;
-    DISALLOW_EVIL_CONSTRUCTORS(PluginHolder);
-};
-
 CasImpl::CasImpl(const sp<ICasListener> &listener)
-    : mPluginHolder(NULL), mListener(listener) {
+    : mListener(listener) {
     ALOGV("CTOR");
 }
 
@@ -69,7 +58,8 @@ void CasImpl::OnEvent(
 
 void CasImpl::init(const sp<SharedLibrary>& library, CasPlugin *plugin) {
     mLibrary = library;
-    mPluginHolder = new PluginHolder(plugin);
+    std::shared_ptr<CasPlugin> holder(plugin);
+    std::atomic_store(&mPluginHolder, holder);
 }
 
 void CasImpl::onEvent(
@@ -88,21 +78,22 @@ void CasImpl::onEvent(
 
 Return<Status> CasImpl::setPrivateData(const HidlCasData& pvtData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->setPrivateData(pvtData));
+    return toStatus(holder->setPrivateData(pvtData));
 }
 
 Return<void> CasImpl::openSession(openSession_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
     CasSessionId sessionId;
 
-    sp<PluginHolder> holder = mPluginHolder;
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     status_t err = INVALID_OPERATION;
-    if (holder != NULL) {
-        err = holder->get()->openSession(&sessionId);
+    if (holder.get() != nullptr) {
+        err = holder->openSession(&sessionId);
+        holder.reset();
     }
 
     _hidl_cb(toStatus(err), sessionId);
@@ -114,87 +105,87 @@ Return<Status> CasImpl::setSessionPrivateData(
         const HidlCasSessionId &sessionId, const HidlCasData& pvtData) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(
-            holder->get()->setSessionPrivateData(
-                    sessionId, pvtData));
+    return toStatus(holder->setSessionPrivateData(sessionId, pvtData));
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId &sessionId) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->closeSession(sessionId));
+    return toStatus(holder->closeSession(sessionId));
 }
 
 Return<Status> CasImpl::processEcm(
         const HidlCasSessionId &sessionId, const HidlCasData& ecm) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEcm(sessionId, ecm));
+    return toStatus(holder->processEcm(sessionId, ecm));
 }
 
 Return<Status> CasImpl::processEmm(const HidlCasData& emm) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEmm(emm));
+    return toStatus(holder->processEmm(emm));
 }
 
 Return<Status> CasImpl::sendEvent(
         int32_t event, int32_t arg,
         const HidlCasData& eventData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->sendEvent(event, arg, eventData);
+    status_t err = holder->sendEvent(event, arg, eventData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::provision(const hidl_string& provisionString) {
     ALOGV("%s: provisionString=%s", __FUNCTION__, provisionString.c_str());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->provision(String8(provisionString.c_str())));
+    return toStatus(holder->provision(String8(provisionString.c_str())));
 }
 
 Return<Status> CasImpl::refreshEntitlements(
         int32_t refreshType,
         const HidlCasData& refreshData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->refreshEntitlements(refreshType, refreshData);
+    status_t err = holder->refreshEntitlements(refreshType, refreshData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::release() {
-    ALOGV("%s: plugin=%p", __FUNCTION__,
-            mPluginHolder != NULL ? mPluginHolder->get() : NULL);
-    mPluginHolder.clear();
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
+
+    std::shared_ptr<CasPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
+
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/CasImpl.h b/cas/1.0/default/CasImpl.h
index 841d64e038..d7928381cc 100644
--- a/cas/1.0/default/CasImpl.h
+++ b/cas/1.0/default/CasImpl.h
@@ -88,7 +88,7 @@ public:
 private:
     struct PluginHolder;
     sp<SharedLibrary> mLibrary;
-    sp<PluginHolder> mPluginHolder;
+    std::shared_ptr<CasPlugin> mPluginHolder;
     sp<ICasListener> mListener;
 
     DISALLOW_EVIL_CONSTRUCTORS(CasImpl);
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp
index 36699baf28..6d5e2d5e32 100644
--- a/cas/1.0/default/DescramblerImpl.cpp
+++ b/cas/1.0/default/DescramblerImpl.cpp
@@ -50,12 +50,12 @@ CHECK_SUBSAMPLE_DEF(CryptoPlugin);
 
 DescramblerImpl::DescramblerImpl(
         const sp<SharedLibrary>& library, DescramblerPlugin *plugin) :
-        mLibrary(library), mPlugin(plugin) {
-    ALOGV("CTOR: mPlugin=%p", mPlugin);
+        mLibrary(library), mPluginHolder(plugin) {
+    ALOGV("CTOR: plugin=%p", mPluginHolder.get());
 }
 
 DescramblerImpl::~DescramblerImpl() {
-    ALOGV("DTOR: mPlugin=%p", mPlugin);
+    ALOGV("DTOR: plugin=%p", mPluginHolder.get());
     release();
 }
 
@@ -63,12 +63,22 @@ Return<Status> DescramblerImpl::setMediaCasSession(const HidlCasSessionId& sessi
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
 
-    return toStatus(mPlugin->setMediaCasSession(sessionId));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->setMediaCasSession(sessionId));
 }
 
 Return<bool> DescramblerImpl::requiresSecureDecoderComponent(
         const hidl_string& mime) {
-    return mPlugin->requiresSecureDecoderComponent(String8(mime.c_str()));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return false;
+    }
+
+    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
 }
 
 static inline bool validateRangeForSize(
@@ -86,6 +96,16 @@ Return<void> DescramblerImpl::descramble(
         descramble_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
 
+    // hidl_memory's size is stored in uint64_t, but mapMemory's mmap will map
+    // size in size_t. If size is over SIZE_MAX, mapMemory mapMemory could succeed
+    // but the mapped memory's actual size will be smaller than the reported size.
+    if (srcBuffer.heapBase.size() > SIZE_MAX) {
+        ALOGE("Invalid hidl_memory size: %llu", srcBuffer.heapBase.size());
+        android_errorWriteLog(0x534e4554, "79376389");
+        _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
+        return Void();
+    }
+
     sp<IMemory> srcMem = mapMemory(srcBuffer.heapBase);
 
     // Validate if the offset and size in the SharedBuffer is consistent with the
@@ -143,10 +163,21 @@ Return<void> DescramblerImpl::descramble(
                 dstBuffer.secureMemory.getNativeHandle());
         dstPtr = static_cast<void *>(handle);
     }
+
+    // Get a local copy of the shared_ptr for the plugin. Note that before
+    // calling the HIDL callback, this shared_ptr must be manually reset,
+    // since the client side could proceed as soon as the callback is called
+    // without waiting for this method to go out of scope.
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        _hidl_cb(toStatus(INVALID_OPERATION), 0, NULL);
+        return Void();
+    }
+
     // Casting hidl SubSample to DescramblerPlugin::SubSample, but need
     // to ensure structs are actually idential
 
-    int32_t result = mPlugin->descramble(
+    int32_t result = holder->descramble(
             dstBuffer.type != BufferType::SHARED_MEMORY,
             (DescramblerPlugin::ScramblingControl)scramblingControl,
             subSamples.size(),
@@ -157,17 +188,17 @@ Return<void> DescramblerImpl::descramble(
             dstOffset,
             NULL);
 
+    holder.reset();
     _hidl_cb(toStatus(result >= 0 ? OK : result), result, NULL);
     return Void();
 }
 
 Return<Status> DescramblerImpl::release() {
-    ALOGV("%s: mPlugin=%p", __FUNCTION__, mPlugin);
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
+
+    std::shared_ptr<DescramblerPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
 
-    if (mPlugin != NULL) {
-        delete mPlugin;
-        mPlugin = NULL;
-    }
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/DescramblerImpl.h b/cas/1.0/default/DescramblerImpl.h
index d3b146ecc7..305f115473 100644
--- a/cas/1.0/default/DescramblerImpl.h
+++ b/cas/1.0/default/DescramblerImpl.h
@@ -55,7 +55,7 @@ public:
 
 private:
     sp<SharedLibrary> mLibrary;
-    DescramblerPlugin *mPlugin;
+    std::shared_ptr<DescramblerPlugin> mPluginHolder;
 
     DISALLOW_EVIL_CONSTRUCTORS(DescramblerImpl);
 };