From 934a83ffe2fde533ede5bdbf69e87b4b097c0392 Mon Sep 17 00:00:00 2001 From: Manikanta Sivapala Date: Wed, 16 Dec 2015 10:42:04 +0530 Subject: mm-video: swvenc: No longer access 'extradata' fields. No longer access 'extradata' fields in SwVenc's output buffer structure. Change-Id: Iaf47b21fe1e211c75e9b86fadcc467e86a2a7301 --- mm-video-v4l2/vidc/venc/src/omx_swvenc_mpeg4.cpp | 5 ----- 1 file changed, 5 deletions(-) diff --git a/mm-video-v4l2/vidc/venc/src/omx_swvenc_mpeg4.cpp b/mm-video-v4l2/vidc/venc/src/omx_swvenc_mpeg4.cpp index 6ca1ba07..c4d0ee2e 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_swvenc_mpeg4.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_swvenc_mpeg4.cpp @@ -1895,8 +1895,6 @@ bool omx_venc::dev_fill_buf opbuffer.size = bufhdr->nAllocLen; opbuffer.filled_length = bufhdr->nFilledLen; opbuffer.flags = bufhdr->nFlags; - opbuffer.extradata_type = SWVENC_EXTRADATA_TYPE_NONE; - opbuffer.p_extradata = NULL; opbuffer.p_client_data = (unsigned char *)bufhdr; DEBUG_PRINT_LOW("FTB: p_buffer (%p) size (%d) filled_len (%d) flags (0x%X) timestamp (%lld) clientData (%p)", @@ -1906,9 +1904,6 @@ bool omx_venc::dev_fill_buf opbuffer.flags, opbuffer.timestamp, opbuffer.p_client_data); - DEBUG_PRINT_LOW("FTB: extradata_type (%d) p_extradata (%p)", - opbuffer.extradata_type, - opbuffer.p_extradata); if ( false == m_bSeqHdrRequested) { -- cgit v1.2.3 From f53dc8a68c8a810346f686c81ff90479a074089d Mon Sep 17 00:00:00 2001 From: Sanjay Singh Date: Wed, 20 Apr 2016 14:22:50 +0530 Subject: mm-video-v4l2: vidc: validate omx param/config data Check the sanity of config/param strcuture objects passed to get/set _ config()/parameter() methods. Bug: 27533317 Security Vulnerability in MediaServer omx_vdec::get_config() Can lead to arbitrary write Change-Id: I6c3243afe12055ab94f1a1ecf758c10e88231809 --- mm-core/inc/OMX_QCOMExtns.h | 21 +++++++- mm-video-v4l2/vidc/common/inc/vidc_debug.h | 13 ++++- mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp | 60 ++++++++++++++++++++--- mm-video-v4l2/vidc/venc/src/omx_video_base.cpp | 41 +++++++++++++++- mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp | 46 +++++++++++++++++ 5 files changed, 169 insertions(+), 12 deletions(-) diff --git a/mm-core/inc/OMX_QCOMExtns.h b/mm-core/inc/OMX_QCOMExtns.h index 4a0d6240..f1ef8fed 100644 --- a/mm-core/inc/OMX_QCOMExtns.h +++ b/mm-core/inc/OMX_QCOMExtns.h @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2009-2015, The Linux Foundation. All rights reserved. +Copyright (c) 2009-2016, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -1468,6 +1468,8 @@ typedef struct QOMX_VIDEO_QUERY_DECODER_INSTANCES { } QOMX_VIDEO_QUERY_DECODER_INSTANCES; typedef struct QOMX_ENABLETYPE { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_BOOL bEnable; } QOMX_ENABLETYPE; @@ -1586,6 +1588,8 @@ typedef enum QOMX_VIDEO_PICTURETYPE { typedef struct QOMX_RECTTYPE { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_S32 nLeft; OMX_S32 nTop; OMX_U32 nWidth; @@ -1721,6 +1725,8 @@ typedef enum QOMX_VPP_HQV_HUE_MODE { } QOMX_VPP_HQV_HUE_MODE; typedef struct QOMX_VPP_HQVCTRL_CADE { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; QOMX_VPP_HQV_MODE mode; OMX_U32 level; OMX_S32 contrast; @@ -1728,11 +1734,15 @@ typedef struct QOMX_VPP_HQVCTRL_CADE { } QOMX_VPP_HQVCTRL_CADE; typedef struct QOMX_VPP_HQVCTRL_CNR { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; QOMX_VPP_HQV_MODE mode; OMX_U32 level; } QOMX_VPP_HQVCTRL_CNR; typedef struct QOMX_VPP_HQVCTRL_AIE { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; QOMX_VPP_HQV_MODE mode; QOMX_VPP_HQV_HUE_MODE hue_mode; OMX_U32 cade_level; @@ -1740,17 +1750,22 @@ typedef struct QOMX_VPP_HQVCTRL_AIE { } QOMX_VPP_HQVCTRL_AIE; typedef struct QOMX_VPP_HQVCTRL_CUSTOM { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_U32 id; OMX_U32 len; OMX_U8 data[QOMX_VPP_HQV_CUSTOMPAYLOAD_SZ]; } QOMX_VPP_HQVCTRL_CUSTOM; typedef struct QOMX_VPP_HQVCTRL_GLOBAL_DEMO { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_U32 process_percent; } QOMX_VPP_HQVCTRL_GLOBAL_DEMO; - typedef struct QOMX_VPP_HQVCONTROL { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; QOMX_VPP_HQV_MODE mode; QOMX_VPP_HQVCONTROLTYPE ctrl_type; union { @@ -1764,6 +1779,8 @@ typedef struct QOMX_VPP_HQVCONTROL { /* STRUCTURE TO TURN VPP ON */ typedef struct QOMX_VPP_ENABLE { + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_BOOL enable_vpp; } QOMX_VPP_ENABLE; diff --git a/mm-video-v4l2/vidc/common/inc/vidc_debug.h b/mm-video-v4l2/vidc/common/inc/vidc_debug.h index d7a158cd..0ce747c4 100644 --- a/mm-video-v4l2/vidc/common/inc/vidc_debug.h +++ b/mm-video-v4l2/vidc/common/inc/vidc_debug.h @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2013, The Linux Foundation. All rights reserved. +Copyright (c) 2013 - 2016, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -64,4 +64,15 @@ extern int debug_level; #define DEBUG_PRINT_HIGH printf #endif +#define VALIDATE_OMX_PARAM_DATA(ptr, paramType) \ + { \ + if (ptr == NULL) { return OMX_ErrorBadParameter; } \ + paramType *p = reinterpret_cast(ptr); \ + if (p->nSize < sizeof(paramType)) { \ + ALOGE("Insufficient object size(%u) v/s expected(%zu) for type %s",\ + (unsigned int)p->nSize, sizeof(paramType), #paramType); \ + return OMX_ErrorBadParameter; \ + } \ + } \ + #endif diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index 337cd3e0..5c348f91 100644 --- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -2957,6 +2957,7 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } switch ((unsigned long)paramIndex) { case OMX_IndexParamPortDefinition: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_PORTDEFINITIONTYPE); OMX_PARAM_PORTDEFINITIONTYPE *portDefn = (OMX_PARAM_PORTDEFINITIONTYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamPortDefinition"); @@ -2966,23 +2967,25 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_IndexParamVideoInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *portParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoInit"); portParamType->nVersion.nVersion = OMX_SPEC_VERSION; - portParamType->nSize = sizeof(portParamType); + portParamType->nSize = sizeof(OMX_PORT_PARAM_TYPE); portParamType->nPorts = 2; portParamType->nStartPortNumber = 0; break; } case OMX_IndexParamVideoPortFormat: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PORTFORMATTYPE); OMX_VIDEO_PARAM_PORTFORMATTYPE *portFmt = (OMX_VIDEO_PARAM_PORTFORMATTYPE *)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoPortFormat"); portFmt->nVersion.nVersion = OMX_SPEC_VERSION; - portFmt->nSize = sizeof(portFmt); + portFmt->nSize = sizeof(OMX_VIDEO_PARAM_PORTFORMATTYPE); if (0 == portFmt->nPortIndex) { if (0 == portFmt->nIndex) { @@ -3024,22 +3027,24 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } /*Component should support this port definition*/ case OMX_IndexParamAudioInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *audioPortParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamAudioInit"); audioPortParamType->nVersion.nVersion = OMX_SPEC_VERSION; - audioPortParamType->nSize = sizeof(audioPortParamType); + audioPortParamType->nSize = sizeof(OMX_PORT_PARAM_TYPE); audioPortParamType->nPorts = 0; audioPortParamType->nStartPortNumber = 0; break; } /*Component should support this port definition*/ case OMX_IndexParamImageInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *imagePortParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamImageInit"); imagePortParamType->nVersion.nVersion = OMX_SPEC_VERSION; - imagePortParamType->nSize = sizeof(imagePortParamType); + imagePortParamType->nSize = sizeof(OMX_PORT_PARAM_TYPE); imagePortParamType->nPorts = 0; imagePortParamType->nStartPortNumber = 0; break; @@ -3053,6 +3058,7 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_IndexParamStandardComponentRole: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_COMPONENTROLETYPE); OMX_PARAM_COMPONENTROLETYPE *comp_role; comp_role = (OMX_PARAM_COMPONENTROLETYPE *) paramData; comp_role->nVersion.nVersion = OMX_SPEC_VERSION; @@ -3066,22 +3072,23 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } /* Added for parameter test */ case OMX_IndexParamPriorityMgmt: { - + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PRIORITYMGMTTYPE); OMX_PRIORITYMGMTTYPE *priorityMgmType = (OMX_PRIORITYMGMTTYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamPriorityMgmt"); priorityMgmType->nVersion.nVersion = OMX_SPEC_VERSION; - priorityMgmType->nSize = sizeof(priorityMgmType); + priorityMgmType->nSize = sizeof(OMX_PRIORITYMGMTTYPE); break; } /* Added for parameter test */ case OMX_IndexParamCompBufferSupplier: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_BUFFERSUPPLIERTYPE); OMX_PARAM_BUFFERSUPPLIERTYPE *bufferSupplierType = (OMX_PARAM_BUFFERSUPPLIERTYPE*) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamCompBufferSupplier"); - bufferSupplierType->nSize = sizeof(bufferSupplierType); + bufferSupplierType->nSize = sizeof(OMX_PARAM_BUFFERSUPPLIERTYPE); bufferSupplierType->nVersion.nVersion = OMX_SPEC_VERSION; if (0 == bufferSupplierType->nPortIndex) bufferSupplierType->nPortIndex = OMX_BufferSupplyUnspecified; @@ -3119,6 +3126,7 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_IndexParamVideoProfileLevelQuerySupported: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PROFILELEVELTYPE); DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoProfileLevelQuerySupported %08x", paramIndex); OMX_VIDEO_PARAM_PROFILELEVELTYPE *profileLevelType = (OMX_VIDEO_PARAM_PROFILELEVELTYPE *)paramData; @@ -3127,6 +3135,7 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } #if defined (_ANDROID_HONEYCOMB_) || defined (_ANDROID_ICS_) case OMX_GoogleAndroidIndexGetAndroidNativeBufferUsage: { + VALIDATE_OMX_PARAM_DATA(paramData, GetAndroidNativeBufferUsageParams); DEBUG_PRINT_LOW("get_parameter: OMX_GoogleAndroidIndexGetAndroidNativeBufferUsage"); GetAndroidNativeBufferUsageParams* nativeBuffersUsage = (GetAndroidNativeBufferUsageParams *) paramData; if (nativeBuffersUsage->nPortIndex == OMX_CORE_OUTPUT_PORT_INDEX) { @@ -3157,6 +3166,7 @@ OMX_ERRORTYPE omx_vdec::get_parameter(OMX_IN OMX_HANDLETYPE hComp, #ifdef FLEXYUV_SUPPORTED case OMX_QcomIndexFlexibleYUVDescription: { DEBUG_PRINT_LOW("get_parameter: describeColorFormat"); + VALIDATE_OMX_PARAM_DATA(paramData, DescribeColorFormatParams); eRet = describeColorFormat((DescribeColorFormatParams *)paramData); break; } @@ -3264,6 +3274,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } switch ((unsigned long)paramIndex) { case OMX_IndexParamPortDefinition: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_PORTDEFINITIONTYPE); OMX_PARAM_PORTDEFINITIONTYPE *portDefn; portDefn = (OMX_PARAM_PORTDEFINITIONTYPE *) paramData; //TODO: Check if any allocate buffer/use buffer/useNativeBuffer has @@ -3492,6 +3503,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } break; case OMX_IndexParamVideoPortFormat: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PORTFORMATTYPE); OMX_VIDEO_PARAM_PORTFORMATTYPE *portFmt = (OMX_VIDEO_PARAM_PORTFORMATTYPE *)paramData; int ret=0; @@ -3538,6 +3550,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_QcomIndexPortDefn: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_PARAM_PORTDEFINITIONTYPE); OMX_QCOM_PARAM_PORTDEFINITIONTYPE *portFmt = (OMX_QCOM_PARAM_PORTDEFINITIONTYPE *) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexQcomParamPortDefinitionType %u", @@ -3577,6 +3590,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_IndexParamStandardComponentRole: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_COMPONENTROLETYPE); OMX_PARAM_COMPONENTROLETYPE *comp_role; comp_role = (OMX_PARAM_COMPONENTROLETYPE *) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamStandardComponentRole %s", @@ -3667,6 +3681,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamPriorityMgmt: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PRIORITYMGMTTYPE); if (m_state != OMX_StateLoaded) { DEBUG_PRINT_ERROR("Set Parameter called in Invalid State"); return OMX_ErrorIncorrectStateOperation; @@ -3685,6 +3700,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamCompBufferSupplier: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_BUFFERSUPPLIERTYPE); OMX_PARAM_BUFFERSUPPLIERTYPE *bufferSupplierType = (OMX_PARAM_BUFFERSUPPLIERTYPE*) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamCompBufferSupplier %d", bufferSupplierType->eBufferSupplier); @@ -3724,6 +3740,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_QcomIndexParamVideoDecoderPictureOrder: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_DECODER_PICTURE_ORDER); QOMX_VIDEO_DECODER_PICTURE_ORDER *pictureOrder = (QOMX_VIDEO_DECODER_PICTURE_ORDER *)paramData; struct v4l2_control control; @@ -3749,42 +3766,52 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_QcomIndexParamConcealMBMapExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(VDEC_EXTRADATA_MB_ERROR_MAP, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamFrameInfoExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_FRAMEINFO_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_ExtraDataFrameDimension: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_FRAMEDIMENSION_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamInterlaceExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_INTERLACE_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamH264TimeInfo: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_TIMEINFO_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamVideoFramePackingExtradata: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_FRAMEPACK_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamVideoQPExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_QP_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamVideoInputBitsInfoExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_BITSINFO_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexEnableExtnUserData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_EXTNUSER_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; case OMX_QcomIndexParamMpeg2SeqDispExtraData: + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); eRet = enable_extradata(OMX_MPEG2SEQDISP_EXTRADATA, false, ((QOMX_ENABLETYPE *)paramData)->bEnable); break; @@ -3793,6 +3820,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } break; case OMX_QcomIndexPlatformPvt: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_PLATFORMPRIVATE_EXTN); DEBUG_PRINT_HIGH("set_parameter: OMX_QcomIndexPlatformPvt OP Port"); OMX_QCOM_PLATFORMPRIVATE_EXTN* entryType = (OMX_QCOM_PLATFORMPRIVATE_EXTN *) paramData; if (entryType->type != OMX_QCOM_PLATFORM_PRIVATE_PMEM) { @@ -3843,6 +3871,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_QcomIndexParamIndexExtraDataType: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_INDEXEXTRADATATYPE); QOMX_INDEXEXTRADATATYPE *extradataIndexType = (QOMX_INDEXEXTRADATATYPE *) paramData; if ((extradataIndexType->nIndex == OMX_IndexParamPortDefinition) && (extradataIndexType->bEnabled == OMX_TRUE) && @@ -3866,6 +3895,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, * state. This is ANDROID architecture which is not in sync * with openmax standard. */ case OMX_GoogleAndroidIndexEnableAndroidNativeBuffers: { + VALIDATE_OMX_PARAM_DATA(paramData, EnableAndroidNativeBuffersParams); EnableAndroidNativeBuffersParams* enableNativeBuffers = (EnableAndroidNativeBuffersParams *) paramData; if (enableNativeBuffers) { m_enable_android_native_buffers = enableNativeBuffers->enable; @@ -3882,11 +3912,13 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } break; case OMX_GoogleAndroidIndexUseAndroidNativeBuffer: { + VALIDATE_OMX_PARAM_DATA(paramData, UseAndroidNativeBufferParams); eRet = use_android_native_buffer(hComp, paramData); } break; #endif case OMX_QcomIndexParamEnableTimeStampReorder: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_INDEXTIMESTAMPREORDER); QOMX_INDEXTIMESTAMPREORDER *reorder = (QOMX_INDEXTIMESTAMPREORDER *)paramData; if (drv_ctx.picture_order == (vdec_output_order)QOMX_VIDEO_DISPLAY_ORDER) { if (reorder->bEnable == OMX_TRUE) { @@ -3903,6 +3935,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } break; case OMX_IndexParamVideoProfileLevelCurrent: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PROFILELEVELTYPE); OMX_VIDEO_PARAM_PROFILELEVELTYPE* pParam = (OMX_VIDEO_PARAM_PROFILELEVELTYPE*)paramData; if (pParam) { @@ -3914,6 +3947,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamVideoMetaBufferMode: { + VALIDATE_OMX_PARAM_DATA(paramData, StoreMetaDataInBuffersParams); StoreMetaDataInBuffersParams *metabuffer = (StoreMetaDataInBuffersParams *)paramData; if (!metabuffer) { @@ -3956,6 +3990,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamVideoDownScalar: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_INDEXDOWNSCALAR); QOMX_INDEXDOWNSCALAR* pParam = (QOMX_INDEXDOWNSCALAR*)paramData; struct v4l2_control control; int rc; @@ -3984,6 +4019,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #ifdef ADAPTIVE_PLAYBACK_SUPPORTED case OMX_QcomIndexParamVideoAdaptivePlaybackMode: { + VALIDATE_OMX_PARAM_DATA(paramData, PrepareForAdaptivePlaybackParams); DEBUG_PRINT_LOW("set_parameter: OMX_GoogleAndroidIndexPrepareForAdaptivePlayback"); PrepareForAdaptivePlaybackParams* pParams = (PrepareForAdaptivePlaybackParams *) paramData; @@ -4012,6 +4048,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #endif case OMX_QcomIndexParamVideoCustomBufferSize: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_CUSTOM_BUFFERSIZE); DEBUG_PRINT_LOW("set_parameter: OMX_QcomIndexParamVideoCustomBufferSize"); QOMX_VIDEO_CUSTOM_BUFFERSIZE* pParam = (QOMX_VIDEO_CUSTOM_BUFFERSIZE*)paramData; if (pParam->nPortIndex == OMX_CORE_INPUT_PORT_INDEX) { @@ -4039,6 +4076,7 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamVideoProcessNotCodedVOP: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_ENABLETYPE); DEBUG_PRINT_LOW("set_parameter: OMX_QcomIndexParamVideoProcessNotCodedVOP"); ignore_not_coded_vops = !((QOMX_ENABLETYPE *)paramData)->bEnable; break; @@ -4081,6 +4119,7 @@ OMX_ERRORTYPE omx_vdec::get_config(OMX_IN OMX_HANDLETYPE hComp, switch ((unsigned long)configIndex) { case OMX_QcomIndexConfigInterlaced: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_QCOM_CONFIG_INTERLACETYPE); OMX_QCOM_CONFIG_INTERLACETYPE *configFmt = (OMX_QCOM_CONFIG_INTERLACETYPE *) configData; if (configFmt->nPortIndex == 1) { @@ -4106,6 +4145,7 @@ OMX_ERRORTYPE omx_vdec::get_config(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_QcomIndexQueryNumberOfVideoDecInstance: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_QUERY_DECODER_INSTANCES); QOMX_VIDEO_QUERY_DECODER_INSTANCES *decoderinstances = (QOMX_VIDEO_QUERY_DECODER_INSTANCES*)configData; decoderinstances->nNumOfInstances = 16; @@ -4114,6 +4154,7 @@ OMX_ERRORTYPE omx_vdec::get_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexConfigVideoFramePackingArrangement: { if (drv_ctx.decoder_format == VDEC_CODECTYPE_H264) { + VALIDATE_OMX_PARAM_DATA(configData, OMX_QCOM_FRAME_PACK_ARRANGEMENT); OMX_QCOM_FRAME_PACK_ARRANGEMENT *configFmt = (OMX_QCOM_FRAME_PACK_ARRANGEMENT *) configData; memcpy(configFmt, &m_frame_pack_arrangement, @@ -4124,6 +4165,7 @@ OMX_ERRORTYPE omx_vdec::get_config(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_IndexConfigCommonOutputCrop: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_RECTTYPE); OMX_CONFIG_RECTTYPE *rect = (OMX_CONFIG_RECTTYPE *) configData; memcpy(rect, &rectangle, sizeof(OMX_CONFIG_RECTTYPE)); DEBUG_PRINT_HIGH("get_config: crop info: L: %u, T: %u, R: %u, B: %u", @@ -4132,6 +4174,7 @@ OMX_ERRORTYPE omx_vdec::get_config(OMX_IN OMX_HANDLETYPE hComp, break; } case OMX_QcomIndexConfigPerfLevel: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_QCOM_VIDEO_CONFIG_PERF_LEVEL); struct v4l2_control control; OMX_QCOM_VIDEO_CONFIG_PERF_LEVEL *perf = (OMX_QCOM_VIDEO_CONFIG_PERF_LEVEL *)configData; @@ -4303,6 +4346,7 @@ OMX_ERRORTYPE omx_vdec::set_config(OMX_IN OMX_HANDLETYPE hComp, struct v4l2_control temp; temp.id = V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT; + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_NALSIZE); pNal = reinterpret_cast < OMX_VIDEO_CONFIG_NALSIZE * >(configData); switch (pNal->nNaluBytes) { case 0: @@ -8747,7 +8791,7 @@ OMX_ERRORTYPE omx_vdec::update_portdef(OMX_PARAM_PORTDEFINITIONTYPE *portDefn) } DEBUG_PRINT_LOW("omx_vdec::update_portdef"); portDefn->nVersion.nVersion = OMX_SPEC_VERSION; - portDefn->nSize = sizeof(portDefn); + portDefn->nSize = sizeof(OMX_PARAM_PORTDEFINITIONTYPE); portDefn->eDomain = OMX_PortDomainVideo; if (drv_ctx.frame_rate.fps_denominator > 0) portDefn->format.video.xFramerate = (drv_ctx.frame_rate.fps_numerator / diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp index a4818727..302cf78c 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp @@ -84,6 +84,8 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. typedef struct OMXComponentCapabilityFlagsType { ////////////////// OMX COMPONENT CAPABILITY RELATED MEMBERS + OMX_U32 nSize; + OMX_VERSIONTYPE nVersion; OMX_BOOL iIsOMXComponentMultiThreaded; OMX_BOOL iOMXComponentSupportsExternalOutputBufferAlloc; OMX_BOOL iOMXComponentSupportsExternalInputBufferAlloc; @@ -1443,6 +1445,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, switch ((int)paramIndex) { case OMX_IndexParamPortDefinition: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_PORTDEFINITIONTYPE); OMX_PARAM_PORTDEFINITIONTYPE *portDefn; portDefn = (OMX_PARAM_PORTDEFINITIONTYPE *) paramData; @@ -1484,6 +1487,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *portParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoInit"); @@ -1493,6 +1497,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoPortFormat: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PORTFORMATTYPE); OMX_VIDEO_PARAM_PORTFORMATTYPE *portFmt = (OMX_VIDEO_PARAM_PORTFORMATTYPE *)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoPortFormat"); @@ -1527,6 +1532,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoBitrate: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_BITRATETYPE); OMX_VIDEO_PARAM_BITRATETYPE* pParam = (OMX_VIDEO_PARAM_BITRATETYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoBitrate"); @@ -1541,6 +1547,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoMpeg4: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_MPEG4TYPE); OMX_VIDEO_PARAM_MPEG4TYPE* pParam = (OMX_VIDEO_PARAM_MPEG4TYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoMpeg4"); memcpy(pParam, &m_sParamMPEG4, sizeof(m_sParamMPEG4)); @@ -1548,6 +1555,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoH263: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_H263TYPE); OMX_VIDEO_PARAM_H263TYPE* pParam = (OMX_VIDEO_PARAM_H263TYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoH263"); memcpy(pParam, &m_sParamH263, sizeof(m_sParamH263)); @@ -1555,6 +1563,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoAvc: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_AVCTYPE); OMX_VIDEO_PARAM_AVCTYPE* pParam = (OMX_VIDEO_PARAM_AVCTYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoAvc"); memcpy(pParam, &m_sParamAVC, sizeof(m_sParamAVC)); @@ -1562,6 +1571,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case (OMX_INDEXTYPE)OMX_IndexParamVideoVp8: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_VP8TYPE); OMX_VIDEO_PARAM_VP8TYPE* pParam = (OMX_VIDEO_PARAM_VP8TYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoVp8"); memcpy(pParam, &m_sParamVP8, sizeof(m_sParamVP8)); @@ -1569,6 +1579,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case (OMX_INDEXTYPE)OMX_IndexParamVideoHevc: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_HEVCTYPE); OMX_VIDEO_PARAM_HEVCTYPE* pParam = (OMX_VIDEO_PARAM_HEVCTYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoHevc"); memcpy(pParam, &m_sParamHEVC, sizeof(m_sParamHEVC)); @@ -1576,6 +1587,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoProfileLevelQuerySupported: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PROFILELEVELTYPE); OMX_VIDEO_PARAM_PROFILELEVELTYPE* pParam = (OMX_VIDEO_PARAM_PROFILELEVELTYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoProfileLevelQuerySupported"); eRet = get_supported_profile_level(pParam); @@ -1586,6 +1598,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoProfileLevelCurrent: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PROFILELEVELTYPE); OMX_VIDEO_PARAM_PROFILELEVELTYPE* pParam = (OMX_VIDEO_PARAM_PROFILELEVELTYPE*)paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoProfileLevelCurrent"); memcpy(pParam, &m_sParamProfileLevel, sizeof(m_sParamProfileLevel)); @@ -1594,6 +1607,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, /*Component should support this port definition*/ case OMX_IndexParamAudioInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *audioPortParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamAudioInit"); memcpy(audioPortParamType, &m_sPortParam_audio, sizeof(m_sPortParam_audio)); @@ -1602,6 +1616,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, /*Component should support this port definition*/ case OMX_IndexParamImageInit: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE *imagePortParamType = (OMX_PORT_PARAM_TYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamImageInit"); memcpy(imagePortParamType, &m_sPortParam_img, sizeof(m_sPortParam_img)); @@ -1617,6 +1632,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamStandardComponentRole: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_COMPONENTROLETYPE); OMX_PARAM_COMPONENTROLETYPE *comp_role; comp_role = (OMX_PARAM_COMPONENTROLETYPE *) paramData; comp_role->nVersion.nVersion = OMX_SPEC_VERSION; @@ -1634,7 +1650,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, /* Added for parameter test */ case OMX_IndexParamPriorityMgmt: { - + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PRIORITYMGMTTYPE); OMX_PRIORITYMGMTTYPE *priorityMgmType = (OMX_PRIORITYMGMTTYPE *) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamPriorityMgmt"); memcpy(priorityMgmType, &m_sPriorityMgmt, sizeof(m_sPriorityMgmt)); @@ -1643,6 +1659,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, /* Added for parameter test */ case OMX_IndexParamCompBufferSupplier: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_BUFFERSUPPLIERTYPE); OMX_PARAM_BUFFERSUPPLIERTYPE *bufferSupplierType = (OMX_PARAM_BUFFERSUPPLIERTYPE*) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamCompBufferSupplier"); if (bufferSupplierType->nPortIndex ==(OMX_U32) PORT_INDEX_IN) { @@ -1658,6 +1675,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamVideoQuantization: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_QUANTIZATIONTYPE); OMX_VIDEO_PARAM_QUANTIZATIONTYPE *session_qp = (OMX_VIDEO_PARAM_QUANTIZATIONTYPE*) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_IndexParamVideoQuantization"); memcpy(session_qp, &m_sSessionQuantization, sizeof(m_sSessionQuantization)); @@ -1666,6 +1684,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_QcomIndexParamVideoQPRange: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_QPRANGETYPE); OMX_QCOM_VIDEO_PARAM_QPRANGETYPE *qp_range = (OMX_QCOM_VIDEO_PARAM_QPRANGETYPE*) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_QcomIndexParamVideoQPRange"); memcpy(qp_range, &m_sSessionQPRange, sizeof(m_sSessionQPRange)); @@ -1674,6 +1693,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamVideoErrorCorrection: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE); OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE* errorresilience = (OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE*)paramData; DEBUG_PRINT_LOW("OMX_IndexParamVideoErrorCorrection"); errorresilience->bEnableHEC = m_sErrorCorrection.bEnableHEC; @@ -1683,6 +1703,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoIntraRefresh: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_INTRAREFRESHTYPE); OMX_VIDEO_PARAM_INTRAREFRESHTYPE* intrarefresh = (OMX_VIDEO_PARAM_INTRAREFRESHTYPE*)paramData; DEBUG_PRINT_LOW("OMX_IndexParamVideoIntraRefresh"); DEBUG_PRINT_ERROR("OMX_IndexParamVideoIntraRefresh GET"); @@ -1695,6 +1716,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_COMPONENT_CAPABILITY_TYPE_INDEX: { + VALIDATE_OMX_PARAM_DATA(paramData, OMXComponentCapabilityFlagsType); OMXComponentCapabilityFlagsType *pParam = reinterpret_cast(paramData); DEBUG_PRINT_LOW("get_parameter: OMX_COMPONENT_CAPABILITY_TYPE_INDEX"); pParam->iIsOMXComponentMultiThreaded = OMX_TRUE; @@ -1712,6 +1734,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, #if !defined(MAX_RES_720P) || defined(_MSM8974_) case OMX_QcomIndexParamIndexExtraDataType: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_INDEXEXTRADATATYPE); DEBUG_PRINT_LOW("get_parameter: OMX_QcomIndexParamIndexExtraDataType"); QOMX_INDEXEXTRADATATYPE *pParam = (QOMX_INDEXEXTRADATATYPE *)paramData; if (pParam->nIndex == (OMX_INDEXTYPE)OMX_ExtraDataVideoEncoderSliceInfo) { @@ -1757,6 +1780,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexParamVideoLTRCountRangeSupported: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_RANGETYPE); DEBUG_PRINT_HIGH("get_parameter: QOMX_IndexParamVideoLTRCountRangeSupported"); QOMX_EXTNINDEX_RANGETYPE *pParam = (QOMX_EXTNINDEX_RANGETYPE *)paramData; if (pParam->nPortIndex == PORT_INDEX_OUT) { @@ -1777,6 +1801,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_QcomIndexParamVideoLTRCount: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_LTRCOUNT_TYPE); DEBUG_PRINT_LOW("get_parameter: OMX_QcomIndexParamVideoLTRCount"); OMX_QCOM_VIDEO_PARAM_LTRCOUNT_TYPE *pParam = reinterpret_cast(paramData); @@ -1786,6 +1811,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, #endif case QOMX_IndexParamVideoSyntaxHdr: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_PARAMTYPE); DEBUG_PRINT_HIGH("QOMX_IndexParamVideoSyntaxHdr"); QOMX_EXTNINDEX_PARAMTYPE* pParam = reinterpret_cast(paramData); @@ -1831,6 +1857,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexHierarchicalStructure: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_HIERARCHICALLAYERS); QOMX_VIDEO_HIERARCHICALLAYERS* hierp = (QOMX_VIDEO_HIERARCHICALLAYERS*) paramData; DEBUG_PRINT_LOW("get_parameter: OMX_QcomIndexHierarchicalStructure"); memcpy(hierp, &m_sHierLayers, sizeof(m_sHierLayers)); @@ -1838,6 +1865,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamPerfLevel: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_PERF_LEVEL); OMX_U32 perflevel; OMX_QCOM_VIDEO_PARAM_PERF_LEVEL *pParam = reinterpret_cast(paramData); @@ -1852,6 +1880,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamH264VUITimingInfo: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_VUI_TIMING_INFO); OMX_U32 enabled; OMX_QCOM_VIDEO_PARAM_VUI_TIMING_INFO *pParam = reinterpret_cast(paramData); @@ -1866,6 +1895,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamPeakBitrate: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_PEAK_BITRATE); OMX_U32 peakbitrate; OMX_QCOM_VIDEO_PARAM_PEAK_BITRATE *pParam = reinterpret_cast(paramData); @@ -1880,6 +1910,7 @@ OMX_ERRORTYPE omx_video::get_parameter(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexParamVideoInitialQp: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_VIDEO_INITIALQP); QOMX_EXTNINDEX_VIDEO_INITIALQP* initqp = reinterpret_cast(paramData); memcpy(initqp, &m_sParamInitqp, sizeof(m_sParamInitqp)); @@ -1939,18 +1970,21 @@ OMX_ERRORTYPE omx_video::get_config(OMX_IN OMX_HANDLETYPE hComp, switch ((int)configIndex) { case OMX_IndexConfigVideoBitrate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_BITRATETYPE); OMX_VIDEO_CONFIG_BITRATETYPE* pParam = reinterpret_cast(configData); memcpy(pParam, &m_sConfigBitrate, sizeof(m_sConfigBitrate)); break; } case OMX_IndexConfigVideoFramerate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_FRAMERATETYPE); OMX_CONFIG_FRAMERATETYPE* pParam = reinterpret_cast(configData); memcpy(pParam, &m_sConfigFramerate, sizeof(m_sConfigFramerate)); break; } case OMX_IndexConfigCommonRotate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_ROTATIONTYPE); OMX_CONFIG_ROTATIONTYPE* pParam = reinterpret_cast(configData); memcpy(pParam, &m_sConfigFrameRotation, sizeof(m_sConfigFrameRotation)); break; @@ -1958,12 +1992,14 @@ OMX_ERRORTYPE omx_video::get_config(OMX_IN OMX_HANDLETYPE hComp, case QOMX_IndexConfigVideoIntraperiod: { DEBUG_PRINT_LOW("get_config:QOMX_IndexConfigVideoIntraperiod"); + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_INTRAPERIODTYPE); QOMX_VIDEO_INTRAPERIODTYPE* pParam = reinterpret_cast(configData); memcpy(pParam, &m_sIntraperiod, sizeof(m_sIntraperiod)); break; } case OMX_IndexConfigVideoAVCIntraPeriod: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_AVCINTRAPERIOD); OMX_VIDEO_CONFIG_AVCINTRAPERIOD *pParam = reinterpret_cast(configData); DEBUG_PRINT_LOW("get_config: OMX_IndexConfigVideoAVCIntraPeriod"); @@ -1972,6 +2008,7 @@ OMX_ERRORTYPE omx_video::get_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigCommonDeinterlace: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_DEINTERLACE); OMX_VIDEO_CONFIG_DEINTERLACE *pParam = reinterpret_cast(configData); DEBUG_PRINT_LOW("get_config: OMX_IndexConfigCommonDeinterlace"); @@ -1980,6 +2017,7 @@ OMX_ERRORTYPE omx_video::get_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigVideoVp8ReferenceFrame: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_VP8REFERENCEFRAMETYPE); OMX_VIDEO_VP8REFERENCEFRAMETYPE* pParam = reinterpret_cast(configData); DEBUG_PRINT_LOW("get_config: OMX_IndexConfigVideoVp8ReferenceFrame"); @@ -1988,6 +2026,7 @@ OMX_ERRORTYPE omx_video::get_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexConfigPerfLevel: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_QCOM_VIDEO_CONFIG_PERF_LEVEL); OMX_U32 perflevel; OMX_QCOM_VIDEO_CONFIG_PERF_LEVEL *pParam = reinterpret_cast(configData); diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp index 7a98192c..0f0c3281 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp @@ -551,6 +551,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, switch ((int)paramIndex) { case OMX_IndexParamPortDefinition: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_PORTDEFINITIONTYPE); OMX_PARAM_PORTDEFINITIONTYPE *portDefn; portDefn = (OMX_PARAM_PORTDEFINITIONTYPE *) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamPortDefinition H= %d, W = %d", @@ -650,6 +651,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamVideoPortFormat: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PORTFORMATTYPE); OMX_VIDEO_PARAM_PORTFORMATTYPE *portFmt = (OMX_VIDEO_PARAM_PORTFORMATTYPE *)paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoPortFormat %d", @@ -693,6 +695,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; case OMX_IndexParamVideoInit: { //TODO, do we need this index set param + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PORT_PARAM_TYPE); OMX_PORT_PARAM_TYPE* pParam = (OMX_PORT_PARAM_TYPE*)(paramData); DEBUG_PRINT_LOW("Set OMX_IndexParamVideoInit called"); break; @@ -700,6 +703,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamVideoBitrate: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_BITRATETYPE); OMX_VIDEO_PARAM_BITRATETYPE* pParam = (OMX_VIDEO_PARAM_BITRATETYPE*)paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoBitrate"); if (handle->venc_set_param(paramData,OMX_IndexParamVideoBitrate) != true) { @@ -716,6 +720,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoMpeg4: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_MPEG4TYPE); OMX_VIDEO_PARAM_MPEG4TYPE* pParam = (OMX_VIDEO_PARAM_MPEG4TYPE*)paramData; OMX_VIDEO_PARAM_MPEG4TYPE mp4_param; memcpy(&mp4_param, pParam, sizeof(struct OMX_VIDEO_PARAM_MPEG4TYPE)); @@ -769,6 +774,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoAvc: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_AVCTYPE); OMX_VIDEO_PARAM_AVCTYPE* pParam = (OMX_VIDEO_PARAM_AVCTYPE*)paramData; OMX_VIDEO_PARAM_AVCTYPE avc_param; memcpy(&avc_param, pParam, sizeof( struct OMX_VIDEO_PARAM_AVCTYPE)); @@ -828,6 +834,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case (OMX_INDEXTYPE)OMX_IndexParamVideoVp8: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_VP8TYPE); OMX_VIDEO_PARAM_VP8TYPE* pParam = (OMX_VIDEO_PARAM_VP8TYPE*)paramData; OMX_VIDEO_PARAM_VP8TYPE vp8_param; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoVp8"); @@ -844,6 +851,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case (OMX_INDEXTYPE)OMX_IndexParamVideoHevc: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_HEVCTYPE); OMX_VIDEO_PARAM_HEVCTYPE* pParam = (OMX_VIDEO_PARAM_HEVCTYPE*)paramData; OMX_VIDEO_PARAM_HEVCTYPE hevc_param; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoHevc"); @@ -857,6 +865,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoProfileLevelCurrent: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_PROFILELEVELTYPE); OMX_VIDEO_PARAM_PROFILELEVELTYPE* pParam = (OMX_VIDEO_PARAM_PROFILELEVELTYPE*)paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoProfileLevelCurrent"); if (handle->venc_set_param(pParam,OMX_IndexParamVideoProfileLevelCurrent) != true) { @@ -911,6 +920,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamStandardComponentRole: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_COMPONENTROLETYPE); OMX_PARAM_COMPONENTROLETYPE *comp_role; comp_role = (OMX_PARAM_COMPONENTROLETYPE *) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamStandardComponentRole %s", @@ -981,6 +991,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamPriorityMgmt: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PRIORITYMGMTTYPE); DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamPriorityMgmt"); if (m_state != OMX_StateLoaded) { DEBUG_PRINT_ERROR("ERROR: Set Parameter called in Invalid State"); @@ -1001,6 +1012,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamCompBufferSupplier: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_PARAM_BUFFERSUPPLIERTYPE); DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamCompBufferSupplier"); OMX_PARAM_BUFFERSUPPLIERTYPE *bufferSupplierType = (OMX_PARAM_BUFFERSUPPLIERTYPE*) paramData; DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamCompBufferSupplier %d", @@ -1017,6 +1029,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoQuantization: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_QUANTIZATIONTYPE); DEBUG_PRINT_LOW("set_parameter: OMX_IndexParamVideoQuantization"); OMX_VIDEO_PARAM_QUANTIZATIONTYPE *session_qp = (OMX_VIDEO_PARAM_QUANTIZATIONTYPE*) paramData; if (session_qp->nPortIndex == PORT_INDEX_OUT) { @@ -1035,6 +1048,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_QcomIndexParamVideoQPRange: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_QPRANGETYPE); DEBUG_PRINT_LOW("set_parameter: OMX_QcomIndexParamVideoQPRange"); OMX_QCOM_VIDEO_PARAM_QPRANGETYPE *qp_range = (OMX_QCOM_VIDEO_PARAM_QPRANGETYPE*) paramData; if (qp_range->nPortIndex == PORT_INDEX_OUT) { @@ -1053,6 +1067,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_QcomIndexPortDefn: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_PARAM_PORTDEFINITIONTYPE); OMX_QCOM_PARAM_PORTDEFINITIONTYPE* pParam = (OMX_QCOM_PARAM_PORTDEFINITIONTYPE*)paramData; DEBUG_PRINT_LOW("set_parameter: OMX_QcomIndexPortDefn"); @@ -1079,6 +1094,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexParamVideoErrorCorrection: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE); DEBUG_PRINT_LOW("OMX_IndexParamVideoErrorCorrection"); OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE* pParam = (OMX_VIDEO_PARAM_ERRORCORRECTIONTYPE*)paramData; @@ -1091,6 +1107,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexParamVideoIntraRefresh: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_VIDEO_PARAM_INTRAREFRESHTYPE); DEBUG_PRINT_LOW("set_param:OMX_IndexParamVideoIntraRefresh"); OMX_VIDEO_PARAM_INTRAREFRESHTYPE* pParam = (OMX_VIDEO_PARAM_INTRAREFRESHTYPE*)paramData; @@ -1104,6 +1121,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #ifdef _ANDROID_ICS_ case OMX_QcomIndexParamVideoMetaBufferMode: { + VALIDATE_OMX_PARAM_DATA(paramData, StoreMetaDataInBuffersParams); StoreMetaDataInBuffersParams *pParam = (StoreMetaDataInBuffersParams*)paramData; DEBUG_PRINT_HIGH("set_parameter:OMX_QcomIndexParamVideoMetaBufferMode: " @@ -1150,6 +1168,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #if !defined(MAX_RES_720P) || defined(_MSM8974_) case OMX_QcomIndexParamIndexExtraDataType: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_INDEXEXTRADATATYPE); DEBUG_PRINT_HIGH("set_parameter: OMX_QcomIndexParamIndexExtraDataType"); QOMX_INDEXEXTRADATATYPE *pParam = (QOMX_INDEXEXTRADATATYPE *)paramData; bool enable = false; @@ -1230,6 +1249,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexParamVideoLTRMode: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_PARAM_LTRMODE_TYPE); QOMX_VIDEO_PARAM_LTRMODE_TYPE* pParam = (QOMX_VIDEO_PARAM_LTRMODE_TYPE*)paramData; if (!handle->venc_set_param(paramData, (OMX_INDEXTYPE)QOMX_IndexParamVideoLTRMode)) { @@ -1241,6 +1261,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexParamVideoLTRCount: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_PARAM_LTRCOUNT_TYPE); QOMX_VIDEO_PARAM_LTRCOUNT_TYPE* pParam = (QOMX_VIDEO_PARAM_LTRCOUNT_TYPE*)paramData; if (!handle->venc_set_param(paramData, (OMX_INDEXTYPE)QOMX_IndexParamVideoLTRCount)) { @@ -1253,6 +1274,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #endif case OMX_QcomIndexParamVideoMaxAllowedBitrateCheck: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_PARAMTYPE); QOMX_EXTNINDEX_PARAMTYPE* pParam = (QOMX_EXTNINDEX_PARAMTYPE*)paramData; if (pParam->nPortIndex == PORT_INDEX_OUT) { @@ -1270,6 +1292,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #ifdef MAX_RES_1080P case OMX_QcomIndexEnableSliceDeliveryMode: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_PARAMTYPE); QOMX_EXTNINDEX_PARAMTYPE* pParam = (QOMX_EXTNINDEX_PARAMTYPE*)paramData; if (pParam->nPortIndex == PORT_INDEX_OUT) { @@ -1288,6 +1311,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, #endif case OMX_QcomIndexEnableH263PlusPType: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_PARAMTYPE); QOMX_EXTNINDEX_PARAMTYPE* pParam = (QOMX_EXTNINDEX_PARAMTYPE*)paramData; DEBUG_PRINT_LOW("OMX_QcomIndexEnableH263PlusPType"); @@ -1306,6 +1330,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamSequenceHeaderWithIDR: { + VALIDATE_OMX_PARAM_DATA(paramData, PrependSPSPPSToIDRFramesParams); if(!handle->venc_set_param(paramData, (OMX_INDEXTYPE)OMX_QcomIndexParamSequenceHeaderWithIDR)) { DEBUG_PRINT_ERROR("%s: %s", @@ -1317,6 +1342,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamH264AUDelimiter: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_CONFIG_H264_AUD); if(!handle->venc_set_param(paramData, (OMX_INDEXTYPE)OMX_QcomIndexParamH264AUDelimiter)) { DEBUG_PRINT_ERROR("%s: %s", @@ -1328,6 +1354,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexHierarchicalStructure: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_VIDEO_HIERARCHICALLAYERS); QOMX_VIDEO_HIERARCHICALLAYERS* pParam = (QOMX_VIDEO_HIERARCHICALLAYERS*)paramData; DEBUG_PRINT_LOW("OMX_QcomIndexHierarchicalStructure"); @@ -1351,6 +1378,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamPerfLevel: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_PERF_LEVEL); if (!handle->venc_set_param(paramData, (OMX_INDEXTYPE) OMX_QcomIndexParamPerfLevel)) { DEBUG_PRINT_ERROR("ERROR: Setting performance level"); @@ -1360,6 +1388,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamH264VUITimingInfo: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_VUI_TIMING_INFO); if (!handle->venc_set_param(paramData, (OMX_INDEXTYPE) OMX_QcomIndexParamH264VUITimingInfo)) { DEBUG_PRINT_ERROR("ERROR: Setting VUI timing info"); @@ -1369,6 +1398,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexParamPeakBitrate: { + VALIDATE_OMX_PARAM_DATA(paramData, OMX_QCOM_VIDEO_PARAM_PEAK_BITRATE); if (!handle->venc_set_param(paramData, (OMX_INDEXTYPE) OMX_QcomIndexParamPeakBitrate)) { DEBUG_PRINT_ERROR("ERROR: Setting peak bitrate"); @@ -1378,6 +1408,7 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexParamVideoInitialQp: { + VALIDATE_OMX_PARAM_DATA(paramData, QOMX_EXTNINDEX_VIDEO_INITIALQP); if(!handle->venc_set_param(paramData, (OMX_INDEXTYPE)QOMX_IndexParamVideoInitialQp)) { DEBUG_PRINT_ERROR("Request to Enable initial QP failed"); @@ -1492,6 +1523,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, switch ((int)configIndex) { case OMX_IndexConfigVideoBitrate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_BITRATETYPE); OMX_VIDEO_CONFIG_BITRATETYPE* pParam = reinterpret_cast(configData); DEBUG_PRINT_HIGH("set_config(): OMX_IndexConfigVideoBitrate (%u)", (unsigned int)pParam->nEncodeBitrate); @@ -1513,6 +1545,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigVideoFramerate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_FRAMERATETYPE); OMX_CONFIG_FRAMERATETYPE* pParam = reinterpret_cast(configData); DEBUG_PRINT_HIGH("set_config(): OMX_IndexConfigVideoFramerate (0x%x)", (unsigned int)pParam->xEncodeFramerate); @@ -1535,6 +1568,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexConfigVideoIntraperiod: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_INTRAPERIODTYPE); QOMX_VIDEO_INTRAPERIODTYPE* pParam = reinterpret_cast(configData); @@ -1592,6 +1626,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexConfigVideoIntraVOPRefresh: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_INTRAREFRESHVOPTYPE); OMX_CONFIG_INTRAREFRESHVOPTYPE* pParam = reinterpret_cast(configData); @@ -1613,6 +1648,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigCommonRotate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_CONFIG_ROTATIONTYPE); OMX_CONFIG_ROTATIONTYPE *pParam = reinterpret_cast(configData); OMX_S32 nRotation; @@ -1660,6 +1696,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, { DEBUG_PRINT_HIGH("set_config(): OMX_QcomIndexConfigVideoFramePackingArrangement"); if (m_sOutPortFormat.eCompressionFormat == OMX_VIDEO_CodingAVC) { + VALIDATE_OMX_PARAM_DATA(configData, OMX_QCOM_FRAME_PACK_ARRANGEMENT); OMX_QCOM_FRAME_PACK_ARRANGEMENT *configFmt = (OMX_QCOM_FRAME_PACK_ARRANGEMENT *) configData; extra_data_handle.set_frame_pack_data(configFmt); @@ -1670,6 +1707,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexConfigVideoLTRPeriod: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_CONFIG_LTRPERIOD_TYPE); QOMX_VIDEO_CONFIG_LTRPERIOD_TYPE* pParam = (QOMX_VIDEO_CONFIG_LTRPERIOD_TYPE*)configData; if (!handle->venc_set_config(configData, (OMX_INDEXTYPE)QOMX_IndexConfigVideoLTRPeriod)) { DEBUG_PRINT_ERROR("ERROR: Setting LTR period failed"); @@ -1681,6 +1719,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, case OMX_IndexConfigVideoVp8ReferenceFrame: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_VP8REFERENCEFRAMETYPE); OMX_VIDEO_VP8REFERENCEFRAMETYPE* pParam = (OMX_VIDEO_VP8REFERENCEFRAMETYPE*) configData; if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE) OMX_IndexConfigVideoVp8ReferenceFrame)) { DEBUG_PRINT_ERROR("ERROR: Setting VP8 reference frame"); @@ -1692,6 +1731,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, case QOMX_IndexConfigVideoLTRUse: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_CONFIG_LTRUSE_TYPE); QOMX_VIDEO_CONFIG_LTRUSE_TYPE* pParam = (QOMX_VIDEO_CONFIG_LTRUSE_TYPE*)configData; if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE)QOMX_IndexConfigVideoLTRUse)) { DEBUG_PRINT_ERROR("ERROR: Setting LTR use failed"); @@ -1702,6 +1742,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case QOMX_IndexConfigVideoLTRMark: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_VIDEO_CONFIG_LTRMARK_TYPE); QOMX_VIDEO_CONFIG_LTRMARK_TYPE* pParam = (QOMX_VIDEO_CONFIG_LTRMARK_TYPE*)configData; if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE)QOMX_IndexConfigVideoLTRMark)) { DEBUG_PRINT_ERROR("ERROR: Setting LTR mark failed"); @@ -1711,6 +1752,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigVideoAVCIntraPeriod: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_AVCINTRAPERIOD); OMX_VIDEO_CONFIG_AVCINTRAPERIOD *pParam = (OMX_VIDEO_CONFIG_AVCINTRAPERIOD*) configData; DEBUG_PRINT_LOW("set_config: OMX_IndexConfigVideoAVCIntraPeriod"); if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE)OMX_IndexConfigVideoAVCIntraPeriod)) { @@ -1722,6 +1764,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigCommonDeinterlace: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_VIDEO_CONFIG_DEINTERLACE); OMX_VIDEO_CONFIG_DEINTERLACE *pParam = (OMX_VIDEO_CONFIG_DEINTERLACE*) configData; DEBUG_PRINT_LOW("set_config: OMX_IndexConfigCommonDeinterlace"); if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE)OMX_IndexConfigCommonDeinterlace)) { @@ -1733,6 +1776,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_QcomIndexConfigVideoVencPerfMode: { + VALIDATE_OMX_PARAM_DATA(configData, QOMX_EXTNINDEX_VIDEO_PERFMODE); QOMX_EXTNINDEX_VIDEO_PERFMODE* pParam = (QOMX_EXTNINDEX_VIDEO_PERFMODE*)configData; if (!handle->venc_set_config(pParam, (OMX_INDEXTYPE)OMX_QcomIndexConfigVideoVencPerfMode)) { DEBUG_PRINT_ERROR("ERROR: Setting OMX_QcomIndexConfigVideoVencPerfMode failed"); @@ -1742,6 +1786,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigPriority: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_PARAM_U32TYPE); if (!handle->venc_set_config(configData, (OMX_INDEXTYPE)OMX_IndexConfigPriority)) { DEBUG_PRINT_ERROR("Failed to set OMX_IndexConfigPriority"); return OMX_ErrorUnsupportedSetting; @@ -1750,6 +1795,7 @@ OMX_ERRORTYPE omx_venc::set_config(OMX_IN OMX_HANDLETYPE hComp, } case OMX_IndexConfigOperatingRate: { + VALIDATE_OMX_PARAM_DATA(configData, OMX_PARAM_U32TYPE); if (!handle->venc_set_config(configData, (OMX_INDEXTYPE)OMX_IndexConfigOperatingRate)) { DEBUG_PRINT_ERROR("Failed to set OMX_IndexConfigOperatingRate"); return handle->hw_overload ? OMX_ErrorInsufficientResources : -- cgit v1.2.3 From db7c0eb608e0a547602ebf65166972c47e9a6a5b Mon Sep 17 00:00:00 2001 From: Praveen Chavan Date: Tue, 22 Mar 2016 17:47:11 -0700 Subject: mm-video-v4l2: vdec: deprecate unused config OMX_IndexVendorVideoExtraData This config (used to set header offline) is no longer used. Remove handling this config since it uses non-process-safe ways to pass memory pointers. Fixes: Security Vulnerability - Segfault in MediaServer (libOmxVdec problem #2) Bug: 27475409 Change-Id: I7a535a3da485cbe83cf4605a05f9faf70dcca42f --- mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp | 105 +---------------------- 1 file changed, 1 insertion(+), 104 deletions(-) diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index 337cd3e0..a83ef0bc 100644 --- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -4196,110 +4196,7 @@ OMX_ERRORTYPE omx_vdec::set_config(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("Set Config Called"); - if (configIndex == (OMX_INDEXTYPE)OMX_IndexVendorVideoExtraData) { - OMX_VENDOR_EXTRADATATYPE *config = (OMX_VENDOR_EXTRADATATYPE *) configData; - DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData called"); - if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.avc") || - !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mvc")) { - DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData AVC"); - OMX_U32 extra_size; - // Parsing done here for the AVC atom is definitely not generic - // Currently this piece of code is working, but certainly - // not tested with all .mp4 files. - // Incase of failure, we might need to revisit this - // for a generic piece of code. - - // Retrieve size of NAL length field - // byte #4 contains the size of NAL lenght field - nal_length = (config->pData[4] & 0x03) + 1; - - extra_size = 0; - if (nal_length > 2) { - /* Presently we assume that only one SPS and one PPS in AvC1 Atom */ - extra_size = (nal_length - 2) * 2; - } - - // SPS starts from byte #6 - OMX_U8 *pSrcBuf = (OMX_U8 *) (&config->pData[6]); - OMX_U8 *pDestBuf; - m_vendor_config.nPortIndex = config->nPortIndex; - - // minus 6 --> SPS starts from byte #6 - // minus 1 --> picture param set byte to be ignored from avcatom - m_vendor_config.nDataSize = config->nDataSize - 6 - 1 + extra_size; - m_vendor_config.pData = (OMX_U8 *) malloc(m_vendor_config.nDataSize); - OMX_U32 len; - OMX_U8 index = 0; - // case where SPS+PPS is sent as part of set_config - pDestBuf = m_vendor_config.pData; - - DEBUG_PRINT_LOW("Rxd SPS+PPS nPortIndex[%u] len[%u] data[%p]", - (unsigned int)m_vendor_config.nPortIndex, - (unsigned int)m_vendor_config.nDataSize, - m_vendor_config.pData); - while (index < 2) { - uint8 *psize; - len = *pSrcBuf; - len = len << 8; - len |= *(pSrcBuf + 1); - psize = (uint8 *) & len; - memcpy(pDestBuf + nal_length, pSrcBuf + 2,len); - for (unsigned int i = 0; i < nal_length; i++) { - pDestBuf[i] = psize[nal_length - 1 - i]; - } - //memcpy(pDestBuf,pSrcBuf,(len+2)); - pDestBuf += len + nal_length; - pSrcBuf += len + 2; - index++; - pSrcBuf++; // skip picture param set - len = 0; - } - } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg4") || - !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg2")) { - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = (OMX_U8 *) malloc((config->nDataSize)); - memcpy(m_vendor_config.pData, config->pData,config->nDataSize); - } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.vc1")) { - if (m_vendor_config.pData) { - free(m_vendor_config.pData); - m_vendor_config.pData = NULL; - m_vendor_config.nDataSize = 0; - } - - if (((*((OMX_U32 *) config->pData)) & - VC1_SP_MP_START_CODE_MASK) == - VC1_SP_MP_START_CODE) { - DEBUG_PRINT_LOW("set_config - VC1 simple/main profile"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = - (OMX_U8 *) malloc(config->nDataSize); - memcpy(m_vendor_config.pData, config->pData, - config->nDataSize); - m_vc1_profile = VC1_SP_MP_RCV; - } else if (*((OMX_U32 *) config->pData) == VC1_AP_SEQ_START_CODE) { - DEBUG_PRINT_LOW("set_config - VC1 Advance profile"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = - (OMX_U8 *) malloc((config->nDataSize)); - memcpy(m_vendor_config.pData, config->pData, - config->nDataSize); - m_vc1_profile = VC1_AP; - } else if ((config->nDataSize == VC1_STRUCT_C_LEN)) { - DEBUG_PRINT_LOW("set_config - VC1 Simple/Main profile struct C only"); - m_vendor_config.nPortIndex = config->nPortIndex; - m_vendor_config.nDataSize = config->nDataSize; - m_vendor_config.pData = (OMX_U8*)malloc(config->nDataSize); - memcpy(m_vendor_config.pData,config->pData,config->nDataSize); - m_vc1_profile = VC1_SP_MP_RCV; - } else { - DEBUG_PRINT_LOW("set_config - Error: Unknown VC1 profile"); - } - } - return ret; - } else if (configIndex == OMX_IndexConfigVideoNalSize) { + if (configIndex == OMX_IndexConfigVideoNalSize) { struct v4l2_control temp; temp.id = V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT; -- cgit v1.2.3 From 3c9085fa3bb124852911341abca41250c4cf7c87 Mon Sep 17 00:00:00 2001 From: Praveen Chavan Date: Tue, 22 Mar 2016 17:34:57 -0700 Subject: mm-video-v4l2: vdec: add safety checks for freeing buffers Allow only up to 64 buffers on input/output port (since the allocation bitmap is only 64-wide). Do not allow changing the actual buffer count while still holding allocation (Client can technically negotiate buffer count on a free/disabled port) Add safety checks to free only as many buffers were allocated. Fixes: Security Vulnerability - Heap Overflow and Possible Local Privilege Escalation in MediaServer (libOmxVdec problem #3) Bug: 27532282 Change-Id: I06dd680d43feaef3efdc87311e8a6703e234b523 --- mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp | 62 ++++++++++++++++++++---- 1 file changed, 52 insertions(+), 10 deletions(-) diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index a83ef0bc..18231674 100644 --- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -3357,10 +3357,22 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, break; } - if (!client_buffers.get_buffer_req(buffer_size)) { + if (portDefn->nBufferCountActual > MAX_NUM_INPUT_OUTPUT_BUFFERS) { + DEBUG_PRINT_ERROR("Requested o/p buf count (%u) exceeds limit (%u)", + portDefn->nBufferCountActual, MAX_NUM_INPUT_OUTPUT_BUFFERS); + eRet = OMX_ErrorBadParameter; + } else if (!client_buffers.get_buffer_req(buffer_size)) { DEBUG_PRINT_ERROR("Error in getting buffer requirements"); eRet = OMX_ErrorBadParameter; } else if (!port_format_changed) { + + // Buffer count can change only when port is disabled + if (!release_output_done()) { + DEBUG_PRINT_ERROR("Cannot change o/p buffer count since all buffers are not freed yet !"); + eRet = OMX_ErrorInvalidState; + break; + } + if ( portDefn->nBufferCountActual >= drv_ctx.op_buf.mincount && portDefn->nBufferSize >= drv_ctx.op_buf.buffer_size ) { drv_ctx.op_buf.actualcount = portDefn->nBufferCountActual; @@ -3469,6 +3481,19 @@ OMX_ERRORTYPE omx_vdec::set_parameter(OMX_IN OMX_HANDLETYPE hComp, eRet = OMX_ErrorBadParameter; break; } + if (portDefn->nBufferCountActual > MAX_NUM_INPUT_OUTPUT_BUFFERS) { + DEBUG_PRINT_ERROR("Requested i/p buf count (%u) exceeds limit (%u)", + portDefn->nBufferCountActual, MAX_NUM_INPUT_OUTPUT_BUFFERS); + eRet = OMX_ErrorBadParameter; + break; + } + // Buffer count can change only when port is disabled + if (!release_input_done()) { + DEBUG_PRINT_ERROR("Cannot change i/p buffer count since all buffers are not freed yet !"); + eRet = OMX_ErrorInvalidState; + break; + } + if (portDefn->nBufferCountActual >= drv_ctx.ip_buf.mincount || portDefn->nBufferSize != drv_ctx.ip_buf.buffer_size) { port_format_changed = true; @@ -5801,7 +5826,8 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, nPortIndex = buffer - m_inp_heap_ptr; DEBUG_PRINT_LOW("free_buffer on i/p port - Port idx %d", nPortIndex); - if (nPortIndex < drv_ctx.ip_buf.actualcount) { + if (nPortIndex < drv_ctx.ip_buf.actualcount && + BITMASK_PRESENT(&m_inp_bm_count, nPortIndex)) { // Clear the bit associated with it. BITMASK_CLEAR(&m_inp_bm_count,nPortIndex); BITMASK_CLEAR(&m_heap_inp_bm_count,nPortIndex); @@ -5843,7 +5869,8 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, } else if (port == OMX_CORE_OUTPUT_PORT_INDEX) { // check if the buffer is valid nPortIndex = buffer - client_buffers.get_il_buf_hdr(); - if (nPortIndex < drv_ctx.op_buf.actualcount) { + if (nPortIndex < drv_ctx.op_buf.actualcount && + BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) { DEBUG_PRINT_LOW("free_buffer on o/p port - Port idx %d", nPortIndex); // Clear the bit associated with it. BITMASK_CLEAR(&m_out_bm_count,nPortIndex); @@ -6513,7 +6540,14 @@ OMX_ERRORTYPE omx_vdec::component_deinit(OMX_IN OMX_HANDLETYPE hComp) if (m_out_mem_ptr) { DEBUG_PRINT_LOW("Freeing the Output Memory"); for (i = 0; i < drv_ctx.op_buf.actualcount; i++ ) { - free_output_buffer (&m_out_mem_ptr[i]); + if (BITMASK_PRESENT(&m_out_bm_count, i)) { + BITMASK_CLEAR(&m_out_bm_count, i); + client_buffers.free_output_buffer (&m_out_mem_ptr[i]); + } + + if (release_output_done()) { + break; + } } #ifdef _ANDROID_ICS_ memset(&native_buffer, 0, (sizeof(nativebuffer) * MAX_NUM_INPUT_OUTPUT_BUFFERS)); @@ -6524,11 +6558,19 @@ OMX_ERRORTYPE omx_vdec::component_deinit(OMX_IN OMX_HANDLETYPE hComp) if (m_inp_mem_ptr || m_inp_heap_ptr) { DEBUG_PRINT_LOW("Freeing the Input Memory"); for (i = 0; i Date: Mon, 21 Mar 2016 12:43:42 -0700 Subject: mm-video-v4l2: venc: add safety checks for freeing buffers Allow only up to 64 buffers on input/output port (since the allocation bitmap is only 64-wide). Add safety checks to free only as many buffers were allocated. Fixes: Heap Overflow and Possible Local Privilege Escalation in MediaServer (libOmxVenc problem) Bug: 27532497 Change-Id: I31e576ef9dc542df73aa6b0ea113d72724b50fc6 --- mm-video-v4l2/vidc/venc/inc/omx_video_base.h | 4 ++-- mm-video-v4l2/vidc/venc/src/omx_video_base.cpp | 9 ++++--- mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp | 29 +++++++++++++++++++++-- 3 files changed, 35 insertions(+), 7 deletions(-) diff --git a/mm-video-v4l2/vidc/venc/inc/omx_video_base.h b/mm-video-v4l2/vidc/venc/inc/omx_video_base.h index 6a9c188b..6979b75f 100644 --- a/mm-video-v4l2/vidc/venc/inc/omx_video_base.h +++ b/mm-video-v4l2/vidc/venc/inc/omx_video_base.h @@ -135,9 +135,9 @@ static const char* MEM_DEVICE = "/dev/pmem_smipool"; & BITMASK_FLAG(mIndex)) #define BITMASK_ABSENT(mArray,mIndex) (((mArray)[BITMASK_OFFSET(mIndex)] \ & BITMASK_FLAG(mIndex)) == 0x0) -#ifdef _ANDROID_ICS_ #define MAX_NUM_INPUT_BUFFERS 64 -#endif +#define MAX_NUM_OUTPUT_BUFFERS 64 + void* enc_message_thread(void *); // OMX video class diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp index a4818727..2197502d 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp @@ -2375,7 +2375,6 @@ OMX_ERRORTYPE omx_video::use_output_buffer( *bufferHdr = (m_out_mem_ptr + i ); (*bufferHdr)->pBuffer = (OMX_U8 *)buffer; (*bufferHdr)->pAppPrivate = appData; - BITMASK_SET(&m_out_bm_count,i); if (!m_use_output_pmem) { #ifdef USE_ION @@ -2453,6 +2452,8 @@ OMX_ERRORTYPE omx_video::use_output_buffer( DEBUG_PRINT_ERROR("ERROR: dev_use_buf Failed for o/p buf"); return OMX_ErrorInsufficientResources; } + + BITMASK_SET(&m_out_bm_count,i); } else { DEBUG_PRINT_ERROR("ERROR: All o/p Buffers have been Used, invalid use_buf call for " "index = %u", i); @@ -3159,7 +3160,8 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("free_buffer on i/p port - Port idx %u, actual cnt %u", nPortIndex, (unsigned int)m_sInPortDef.nBufferCountActual); - if (nPortIndex < m_sInPortDef.nBufferCountActual) { + if (nPortIndex < m_sInPortDef.nBufferCountActual && + BITMASK_PRESENT(&m_inp_bm_count, nPortIndex)) { // Clear the bit associated with it. BITMASK_CLEAR(&m_inp_bm_count,nPortIndex); free_input_buffer (buffer); @@ -3209,7 +3211,8 @@ OMX_ERRORTYPE omx_video::free_buffer(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("free_buffer on o/p port - Port idx %u, actual cnt %u", nPortIndex, (unsigned int)m_sOutPortDef.nBufferCountActual); - if (nPortIndex < m_sOutPortDef.nBufferCountActual) { + if (nPortIndex < m_sOutPortDef.nBufferCountActual && + BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) { // Clear the bit associated with it. BITMASK_CLEAR(&m_out_bm_count,nPortIndex); m_sOutPortDef.bPopulated = OMX_FALSE; diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp index 7a98192c..6bb6d65e 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp @@ -567,6 +567,11 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("i/p actual cnt requested = %u", (unsigned int)portDefn->nBufferCountActual); DEBUG_PRINT_LOW("i/p min cnt requested = %u", (unsigned int)portDefn->nBufferCountMin); DEBUG_PRINT_LOW("i/p buffersize requested = %u", (unsigned int)portDefn->nBufferSize); + if (portDefn->nBufferCountActual > MAX_NUM_INPUT_BUFFERS) { + DEBUG_PRINT_ERROR("ERROR: (In_PORT) actual count (%u) exceeds max(%u)", + (unsigned int)portDefn->nBufferCountActual, (unsigned int)MAX_NUM_INPUT_BUFFERS); + return OMX_ErrorUnsupportedSetting; + } if (portDefn->nBufferCountMin > portDefn->nBufferCountActual) { DEBUG_PRINT_ERROR("ERROR: (In_PORT) Min buffers (%u) > actual count (%u)", (unsigned int)portDefn->nBufferCountMin, (unsigned int)portDefn->nBufferCountActual); @@ -615,6 +620,12 @@ OMX_ERRORTYPE omx_venc::set_parameter(OMX_IN OMX_HANDLETYPE hComp, DEBUG_PRINT_LOW("o/p actual cnt requested = %u", (unsigned int)portDefn->nBufferCountActual); DEBUG_PRINT_LOW("o/p min cnt requested = %u", (unsigned int)portDefn->nBufferCountMin); DEBUG_PRINT_LOW("o/p buffersize requested = %u", (unsigned int)portDefn->nBufferSize); + + if (portDefn->nBufferCountActual > MAX_NUM_OUTPUT_BUFFERS) { + DEBUG_PRINT_ERROR("ERROR: (Out_PORT) actual count (%u) exceeds max(%u)", + (unsigned int)portDefn->nBufferCountActual, (unsigned int)MAX_NUM_OUTPUT_BUFFERS); + return OMX_ErrorUnsupportedSetting; + } if (portDefn->nBufferCountMin > portDefn->nBufferCountActual) { DEBUG_PRINT_ERROR("ERROR: (Out_PORT) Min buffers (%u) > actual count (%u)", (unsigned int)portDefn->nBufferCountMin, (unsigned int)portDefn->nBufferCountActual); @@ -1791,7 +1802,14 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp) if (m_out_mem_ptr) { DEBUG_PRINT_LOW("Freeing the Output Memory"); for (i=0; i< m_sOutPortDef.nBufferCountActual; i++ ) { - free_output_buffer (&m_out_mem_ptr[i]); + if (BITMASK_PRESENT(&m_out_bm_count, i)) { + BITMASK_CLEAR(&m_out_bm_count, i); + free_output_buffer (&m_out_mem_ptr[i]); + } + + if (release_output_done()) { + break; + } } free(m_out_mem_ptr); m_out_mem_ptr = NULL; @@ -1805,7 +1823,14 @@ OMX_ERRORTYPE omx_venc::component_deinit(OMX_IN OMX_HANDLETYPE hComp) ) { DEBUG_PRINT_LOW("Freeing the Input Memory"); for (i=0; i