mm-video-v4l2: Protect buffer access and increase input buffer size.
Protect buffer access for below scenarios:
*Increase the scope of buf_lock in free_buffer to avoid access
of freed buffer for both input and output buffers. Also, add check
before output buffer access.
*Disallow allocate buffer mode after client has called use buffer.
Allocate additional 512 bytes of memory for input buffers on top of
allocation size as per hardware requirement.
CRs-Fixed: 2119840
Issue: SEC-1431
Issue: SEC-1432
Change-Id: Ic570d8248806ee492f68b51cb73139cf5c5028e5
(cherry picked from commit https://source.codeaurora.org/quic/la/platform/hardware/qcom/media/commit/?id=d41a7a4c7d43fa67f2e4a487b8a1fb0aac38226d)
diff --git a/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h b/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
index 6637021..980ca11 100644
--- a/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
+++ b/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
@@ -1037,6 +1037,7 @@
}
volatile int32_t m_queued_codec_config_count;
+ bool m_buffer_error;
static OMX_ERRORTYPE describeColorFormat(OMX_PTR params);
};
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index fb182bf..8b9ab16 100644
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -573,7 +573,8 @@
m_profile(0),
client_set_fps(false),
m_last_rendered_TS(-1),
- m_queued_codec_config_count(0)
+ m_queued_codec_config_count(0),
+ m_buffer_error(false)
{
/* Assumption is that , to begin with , we have all the frames with decoder */
DEBUG_PRINT_HIGH("In OMX vdec Constructor");
@@ -4365,6 +4366,7 @@
eRet = allocate_output_headers();
if (eRet == OMX_ErrorNone)
eRet = allocate_extradata();
+ output_use_buffer = true;
}
if (eRet == OMX_ErrorNone) {
@@ -4765,7 +4767,6 @@
index = bufferHdr - m_inp_mem_ptr;
DEBUG_PRINT_LOW("Free Input Buffer index = %d",index);
- auto_lock l(buf_lock);
bufferHdr->pInputPortPrivate = NULL;
if (index < drv_ctx.ip_buf.actualcount && drv_ctx.ptr_inputbuffer) {
@@ -4975,6 +4976,7 @@
unsigned i = 0;
unsigned char *buf_addr = NULL;
int pmem_fd = -1;
+ unsigned int align_size = 0;
if (bytes != drv_ctx.ip_buf.buffer_size) {
DEBUG_PRINT_LOW("Requested Size is wrong %lu epected is %d",
@@ -5030,8 +5032,10 @@
int rc;
DEBUG_PRINT_LOW("Allocate input Buffer");
#ifdef USE_ION
+ align_size = drv_ctx.ip_buf.buffer_size + 512;
+ align_size = (align_size + drv_ctx.ip_buf.alignment - 1)&(~(drv_ctx.ip_buf.alignment - 1));
drv_ctx.ip_buf_ion_info[i].ion_device_fd = alloc_map_ion_memory(
- drv_ctx.ip_buf.buffer_size,drv_ctx.op_buf.alignment,
+ align_size, drv_ctx.op_buf.alignment,
&drv_ctx.ip_buf_ion_info[i].ion_alloc_data,
&drv_ctx.ip_buf_ion_info[i].fd_ion_data, secure_mode ? ION_SECURE : 0);
if (drv_ctx.ip_buf_ion_info[i].ion_device_fd < 0) {
@@ -5512,6 +5516,10 @@
eRet = allocate_input_buffer(hComp,bufferHdr,port,appData,bytes);
}
} else if (port == OMX_CORE_OUTPUT_PORT_INDEX) {
+ if (output_use_buffer) {
+ DEBUG_PRINT_ERROR("Allocate output buffer not allowed after use buffer");
+ return OMX_ErrorBadParameter;
+ }
eRet = client_buffers.allocate_buffers_color_convert(hComp,bufferHdr,port,
appData,bytes);
} else {
@@ -5571,6 +5579,7 @@
unsigned int nPortIndex;
DEBUG_PRINT_LOW("In for decoder free_buffer");
+ auto_lock l(buf_lock);
if (m_state == OMX_StateIdle &&
(BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) {
DEBUG_PRINT_LOW(" free buffer while Component in Loading pending");
@@ -5587,7 +5596,7 @@
post_event(OMX_EventError,
OMX_ErrorPortUnpopulated,
OMX_COMPONENT_GENERATE_EVENT);
-
+ m_buffer_error = true;
return OMX_ErrorIncorrectStateOperation;
} else if (m_state != OMX_StateInvalid) {
DEBUG_PRINT_ERROR("Invalid state to free buffer,port lost Buffers");
@@ -5692,6 +5701,7 @@
BITMASK_CLEAR((&m_flags),OMX_COMPONENT_LOADING_PENDING);
post_event(OMX_CommandStateSet, OMX_StateLoaded,
OMX_COMPONENT_GENERATE_EVENT);
+ m_buffer_error = false;
}
}
return eRet;
@@ -5855,6 +5865,10 @@
if (!temp_buffer || (temp_buffer - drv_ctx.ptr_inputbuffer) > (int)drv_ctx.ip_buf.actualcount) {
return OMX_ErrorBadParameter;
}
+ if (BITMASK_ABSENT(&m_inp_bm_count, nPortIndex) || m_buffer_error) {
+ DEBUG_PRINT_ERROR("ETBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex);
+ return OMX_ErrorBadParameter;
+ }
/* If its first frame, H264 codec and reject is true, then parse the nal
and get the profile. Based on this, reject the clip playback */
if (first_frame == 0 && codec_type_parse == CODEC_TYPE_H264 &&
@@ -6141,6 +6155,7 @@
struct vdec_bufferpayload *ptr_outputbuffer = NULL;
struct vdec_output_frameinfo *ptr_respbuffer = NULL;
+ auto_lock l(buf_lock);
nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr());
if (bufferAdd == NULL || nPortIndex >= drv_ctx.op_buf.actualcount) {
@@ -6148,7 +6163,10 @@
nPortIndex, drv_ctx.op_buf.actualcount);
return OMX_ErrorBadParameter;
}
-
+ if (BITMASK_ABSENT(&m_out_bm_count, nPortIndex) || m_buffer_error) {
+ DEBUG_PRINT_ERROR("FTBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex);
+ return OMX_ErrorBadParameter;
+ }
DEBUG_PRINT_LOW("FTBProxy: bufhdr = %p, bufhdr->pBuffer = %p",
bufferAdd, bufferAdd->pBuffer);
/*Return back the output buffer to client*/
@@ -7281,7 +7299,8 @@
output_respbuf->pic_type = PICTURE_TYPE_B;
}
- if (omx->output_use_buffer)
+ if (!omx->m_enable_android_native_buffers &&
+ omx->output_use_buffer)
memcpy ( omxhdr->pBuffer, (void *)
((unsigned long)vdec_msg->msgdata.output_frame.bufferaddr +
(unsigned long)vdec_msg->msgdata.output_frame.offset),