diff options
author | Praveen Chavan <pchavan@codeaurora.org> | 2016-04-11 17:32:32 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-06-07 15:34:12 -0700 |
commit | d30f731cffd81b11b90ef3d0d672c380cd7959e2 (patch) | |
tree | f83200d4dcf8c429ed75c348c029fe2091dbab86 | |
parent | 98c95e1808e7a5f7d2600e11ef061faee9d4ae9d (diff) | |
download | android_hardware_qcom_media-d30f731cffd81b11b90ef3d0d672c380cd7959e2.tar.gz android_hardware_qcom_media-d30f731cffd81b11b90ef3d0d672c380cd7959e2.tar.bz2 android_hardware_qcom_media-d30f731cffd81b11b90ef3d0d672c380cd7959e2.zip |
DO NOT MERGE mm-video-v4l2: vdec: deprecate unused config OMX_IndexVendorVideoExtraData
This config (used to set header offline) is no longer used. Remove handling
this config since it uses non-process-safe ways to pass memory pointers.
Fixes: Security Vulnerability - Segfault in MediaServer (libOmxVdec problem #2)
Bug: 27475409
Ticket: CYNGNOS-2707
Change-Id: I7a535a3da485cbe83cf4605a05f9faf70dcca42f
(cherry picked from commit d10bb6546aecfdb1e4b72c9716b7a2f20ae57810)
-rw-r--r-- | mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp | 105 |
1 files changed, 1 insertions, 104 deletions
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index db5d50bb..a9607be3 100644 --- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -4297,110 +4297,7 @@ OMX_ERRORTYPE omx_vdec::set_config(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("Set Config Called"); - if (configIndex == (OMX_INDEXTYPE)OMX_IndexVendorVideoExtraData) { - OMX_VENDOR_EXTRADATATYPE *config = (OMX_VENDOR_EXTRADATATYPE *) configData; - DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData called"); - if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.avc") || - !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mvc")) { - DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData AVC"); - OMX_U32 extra_size; - // Parsing done here for the AVC atom is definitely not generic - // Currently this piece of code is working, but certainly - // not tested with all .mp4 files. - // Incase of failure, we might need to revisit this - // for a generic piece of code. - - // Retrieve size of NAL length field - // byte #4 contains the size of NAL lenght field - nal_length = (config->pData[4] & 0x03) + 1; - - extra_size = 0; - if (nal_length > 2) { - /* Presently we assume that only one SPS and one PPS in AvC1 Atom */ - extra_size = (nal_length - 2) * 2; - } - - // SPS starts from byte #6 - OMX_U8 *pSrcBuf = (OMX_U8 *) (&config->pData[6]); - OMX_U8 *pDestBuf; - m_vendor_config.nPortIndex = config->nPortIndex; - - // minus 6 --> SPS starts from byte #6 - // minus 1 --> picture param set byte to be ignored from avcatom - m_vendor_config.nDataSize = config->nDataSize - 6 - 1 + extra_size; - m_vendor_config.pData = (OMX_U8 *) malloc(m_vendor_config.nDataSize); - OMX_U32 len; - OMX_U8 index = 0; - // case where SPS+PPS is sent as part of set_config - pDestBuf = m_vendor_config.pData; - - DEBUG_PRINT_LOW("Rxd SPS+PPS nPortIndex[%u] len[%u] data[%p]", - (unsigned int)m_vendor_config.nPortIndex, - (unsigned int)m_vendor_config.nDataSize, - m_vendor_config.pData); - while (index < 2) { - uint8 *psize; - len = *pSrcBuf; - len = len << 8; - len |= *(pSrcBuf + 1); - psize = (uint8 *) & len; - memcpy(pDestBuf + nal_length, pSrcBuf + 2,len); - for (unsigned int i = 0; i < nal_length; i++) { - pDestBuf[i] = psize[nal_length - 1 - i]; - } - //memcpy(pDestBuf,pSrcBuf,(len+2)); - pDestBuf += len + nal_length; - pSrcBuf += len + 2; - index++; - pSrcBuf++; // skip picture param set - len = 0; - } - } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg4") || - !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg2")) { - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = (OMX_U8 *) malloc((config->nDataSize)); - memcpy(m_vendor_config.pData, config->pData,config->nDataSize); - } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.vc1")) { - if (m_vendor_config.pData) { - free(m_vendor_config.pData); - m_vendor_config.pData = NULL; - m_vendor_config.nDataSize = 0; - } - - if (((*((OMX_U32 *) config->pData)) & - VC1_SP_MP_START_CODE_MASK) == - VC1_SP_MP_START_CODE) { - DEBUG_PRINT_LOW("set_config - VC1 simple/main profile"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = - (OMX_U8 *) malloc(config->nDataSize); - memcpy(m_vendor_config.pData, config->pData, - config->nDataSize); - m_vc1_profile = VC1_SP_MP_RCV; - } else if (*((OMX_U32 *) config->pData) == VC1_AP_SEQ_START_CODE) { - DEBUG_PRINT_LOW("set_config - VC1 Advance profile"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = - (OMX_U8 *) malloc((config->nDataSize)); - memcpy(m_vendor_config.pData, config->pData, - config->nDataSize); - m_vc1_profile = VC1_AP; - } else if ((config->nDataSize == VC1_STRUCT_C_LEN)) { - DEBUG_PRINT_LOW("set_config - VC1 Simple/Main profile struct C only"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = (OMX_U8*)malloc(config->nDataSize); - memcpy(m_vendor_config.pData,config->pData,config->nDataSize); - m_vc1_profile = VC1_SP_MP_RCV; - } else { - DEBUG_PRINT_LOW("set_config - Error: Unknown VC1 profile"); - } - } - return ret; - } else if (configIndex == OMX_IndexConfigVideoNalSize) { + if (configIndex == OMX_IndexConfigVideoNalSize) { struct v4l2_control temp; temp.id = V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT; |