DO NOT MERGE ANYWHERE: mm-video-v4l2: vdec: Disallow changing buffer...
DO NOT MERGE ANYWHERE: mm-video-v4l2: vdec: Disallow changing buffer modes/counts on allocated ports [this message from the lmp-dev commit; this lmp-mr1 version needed some manual merging so it wasn't a simple cherry-pick]. Changing Count, size, usage-mode (metadata/bytebuffer/native-handle) or allocation-mode (allocateBuffer/UseBuffer) of buffers should only be allowed when the port hasn't been allocated yet. Since buffer-modes determine the payload-size in case of meta-buffer-mode, and also determine the memory-base to derive buffer indices from buffer- headers, letting the client change count/size/mode on a pre-allocated port will cause inconsistencies in the size of memory allocated for headers and lead to index overflows. Fix the range checks for the derived buffer-indices to avoid out-of-bounds writes. Also, ensure buffer-mode settings (metadata-mode, native-handle-mode) are intended for the right ports. Bug: 29617572 : Heap Overflow/LPE in MediaServer (libOmxVdec problem #8) Bug: 29982686 : Memory Write/LPE in MediaServer (libOmxVdec problem #10) (The lmp-dev version Change-Id is I619636a48779580c247bffb3752c3e4025b46542) Change-Id: I6f1e8e6936c40859b9b20206edc426efd949aea1
Loading
Please register or sign in to comment