From f2180f3f1a7cfe4916648518770ebeb478760b62 Mon Sep 17 00:00:00 2001 From: Praveen Chavan Date: Wed, 15 Jun 2016 17:51:39 -0700 Subject: DO NOT MERGE mm-video-v4l2: venc: add checks before accessing heap pointers Heap pointers do not point to user virtual addresses in case of secure session. Set them to NULL and add checks to avoid accesing them Ticket: CYNGNOS-3177 Bug: 28815329 Bug: 28920116 Change-Id: I3ceeef19a3e3927370f4d16e5c5b3630a25425f6 --- mm-video-v4l2/vidc/venc/src/omx_video_base.cpp | 21 ++++++++++++++++----- mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp | 2 +- .../vidc/venc/src/video_encoder_device_v4l2.cpp | 10 ++++++++++ 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp index 59e572b5..01457364 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_base.cpp @@ -78,7 +78,6 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #define SZ_4K 0x1000 #define SZ_1M 0x100000 -#define SECURE_BUFPTR 0xDEADBEEF typedef struct OMXComponentCapabilityFlagsType { ////////////////// OMX COMPONENT CAPABILITY RELATED MEMBERS @@ -2210,7 +2209,7 @@ OMX_ERRORTYPE omx_video::use_input_buffer( m_pInput_pmem[i].size = m_sInPortDef.nBufferSize; m_pInput_pmem[i].offset = 0; - m_pInput_pmem[i].buffer = (OMX_U8 *)SECURE_BUFPTR; + m_pInput_pmem[i].buffer = NULL; if(!secure_session) { m_pInput_pmem[i].buffer = (unsigned char *)mmap( NULL,m_pInput_pmem[i].size,PROT_READ|PROT_WRITE, @@ -2218,6 +2217,7 @@ OMX_ERRORTYPE omx_video::use_input_buffer( if (m_pInput_pmem[i].buffer == MAP_FAILED) { DEBUG_PRINT_ERROR("ERROR: mmap() Failed"); + m_pInput_pmem[i].buffer = NULL; close(m_pInput_pmem[i].fd); #ifdef USE_ION free_ion_memory(&m_pInput_ion[i]); @@ -2401,7 +2401,7 @@ OMX_ERRORTYPE omx_video::use_output_buffer( m_pOutput_pmem[i].size = m_sOutPortDef.nBufferSize; m_pOutput_pmem[i].offset = 0; - m_pOutput_pmem[i].buffer = (OMX_U8 *)SECURE_BUFPTR; + m_pOutput_pmem[i].buffer = NULL; if(!secure_session) { #ifdef _MSM8974_ m_pOutput_pmem[i].buffer = (unsigned char *)mmap(NULL, @@ -2414,6 +2414,7 @@ OMX_ERRORTYPE omx_video::use_output_buffer( #endif if (m_pOutput_pmem[i].buffer == MAP_FAILED) { DEBUG_PRINT_ERROR("ERROR: mmap() Failed"); + m_pOutput_pmem[i].buffer = NULL; close(m_pOutput_pmem[i].fd); #ifdef USE_ION free_ion_memory(&m_pOutput_ion[i]); @@ -2807,13 +2808,14 @@ OMX_ERRORTYPE omx_video::allocate_input_buffer( m_pInput_pmem[i].size = m_sInPortDef.nBufferSize; m_pInput_pmem[i].offset = 0; - m_pInput_pmem[i].buffer = (OMX_U8 *)SECURE_BUFPTR; + m_pInput_pmem[i].buffer = NULL; if(!secure_session) { m_pInput_pmem[i].buffer = (unsigned char *)mmap(NULL, m_pInput_pmem[i].size,PROT_READ|PROT_WRITE, MAP_SHARED,m_pInput_pmem[i].fd,0); if (m_pInput_pmem[i].buffer == MAP_FAILED) { DEBUG_PRINT_ERROR("ERROR: mmap FAILED= %d", errno); + m_pInput_pmem[i].buffer = NULL; close(m_pInput_pmem[i].fd); #ifdef USE_ION free_ion_memory(&m_pInput_ion[i]); @@ -2824,6 +2826,10 @@ OMX_ERRORTYPE omx_video::allocate_input_buffer( //This should only be used for passing reference to source type and //secure handle fd struct native_handle_t* m_pInput_pmem[i].buffer = malloc(sizeof(OMX_U32) + sizeof(native_handle_t*)); + if (m_pInput_pmem[i].buffer == NULL) { + DEBUG_PRINT_ERROR("%s: failed to allocate native-handle", __func__); + return OMX_ErrorInsufficientResources; + } (*bufferHdr)->nAllocLen = sizeof(OMX_U32) + sizeof(native_handle_t*); } @@ -2969,7 +2975,7 @@ OMX_ERRORTYPE omx_video::allocate_output_buffer( m_pOutput_pmem[i].size = m_sOutPortDef.nBufferSize; m_pOutput_pmem[i].offset = 0; - m_pOutput_pmem[i].buffer = (OMX_U8 *)SECURE_BUFPTR; + m_pOutput_pmem[i].buffer = NULL; if(!secure_session) { #ifdef _MSM8974_ m_pOutput_pmem[i].buffer = (unsigned char *)mmap(NULL, @@ -2982,6 +2988,7 @@ OMX_ERRORTYPE omx_video::allocate_output_buffer( #endif if (m_pOutput_pmem[i].buffer == MAP_FAILED) { DEBUG_PRINT_ERROR("ERROR: MMAP_FAILED in o/p alloc buffer"); + m_pOutput_pmem[i].buffer = NULL; close (m_pOutput_pmem[i].fd); #ifdef USE_ION free_ion_memory(&m_pOutput_ion[i]); @@ -2993,6 +3000,10 @@ OMX_ERRORTYPE omx_video::allocate_output_buffer( //This should only be used for passing reference to source type and //secure handle fd struct native_handle_t* m_pOutput_pmem[i].buffer = malloc(sizeof(OMX_U32) + sizeof(native_handle_t*)); + if (m_pOutput_pmem[i].buffer == NULL) { + DEBUG_PRINT_ERROR("%s: Failed to allocate native-handle", __func__); + return OMX_ErrorInsufficientResources; + } (*bufferHdr)->nAllocLen = sizeof(OMX_U32) + sizeof(native_handle_t*); native_handle_t *handle = native_handle_create(1, 0); handle->data[0] = m_pOutput_pmem[i].fd; diff --git a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp index c9dff7de..9357403b 100644 --- a/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp +++ b/mm-video-v4l2/vidc/venc/src/omx_video_encoder.cpp @@ -2051,7 +2051,7 @@ int omx_venc::async_message_process (void *context, void* message) omxhdr->nFlags = m_sVenc_msg->buf.flags; /*Use buffer case*/ - if (omx->output_use_buffer && !omx->m_use_output_pmem) { + if (omx->output_use_buffer && !omx->m_use_output_pmem && !omx->is_secure_session()) { DEBUG_PRINT_LOW("memcpy() for o/p Heap UseBuffer"); memcpy(omxhdr->pBuffer, (m_sVenc_msg->buf.ptrbuffer), diff --git a/mm-video-v4l2/vidc/venc/src/video_encoder_device_v4l2.cpp b/mm-video-v4l2/vidc/venc/src/video_encoder_device_v4l2.cpp index b153f097..1c4f8ec2 100755 --- a/mm-video-v4l2/vidc/venc/src/video_encoder_device_v4l2.cpp +++ b/mm-video-v4l2/vidc/venc/src/video_encoder_device_v4l2.cpp @@ -614,6 +614,11 @@ bool venc_dev::venc_get_output_log_flag() int venc_dev::venc_output_log_buffers(const char *buffer_addr, int buffer_len) { + if (venc_handle->is_secure_session()) { + DEBUG_PRINT_ERROR("logging secure output buffers is not allowed!"); + return -1; + } + if (!m_debug.outfile) { int size = 0; if(m_sVenc_cfg.codectype == V4L2_PIX_FMT_MPEG4) { @@ -691,6 +696,11 @@ int venc_dev::venc_extradata_log_buffers(char *buffer_addr) } int venc_dev::venc_input_log_buffers(OMX_BUFFERHEADERTYPE *pbuffer, int fd, int plane_offset) { + if (venc_handle->is_secure_session()) { + DEBUG_PRINT_ERROR("logging secure input buffers is not allowed!"); + return -1; + } + if (!m_debug.infile) { int size = snprintf(m_debug.infile_name, PROPERTY_VALUE_MAX, "%s/input_enc_%lu_%lu_%p.yuv", m_debug.log_loc, m_sVenc_cfg.input_width, m_sVenc_cfg.input_height, this); -- cgit v1.2.3