Merge Android 13 QPR2

Bug: 273316506
Merged-In: I078354717cf7a5a772c8b6d7cbbbbfd457eec600
Change-Id: I288aa3a35b00d97425a0d04faf3d9e8e44072080

2 files changed, 21 insertions, 15 deletions

diff --git a/gralloc4/src/hidl_common/BufferDescriptor.h b/gralloc4/src/hidl_common/BufferDescriptor.h
index abaac62..0d93811 100644
--- a/gralloc4/src/hidl_common/BufferDescriptor.h
+++ b/gralloc4/src/hidl_common/BufferDescriptor.h
@@ -104,6 +104,7 @@ static uint64_t pop_descriptor_uint64(const hidl_vec<vecT> &vec, size_t *pos)
 	return val;
 }
 
+// There can only be one string at the end of the descriptor
 static void push_descriptor_string(hidl_vec<uint8_t> *vec, size_t *pos, const std::string &str)
 {
 	strcpy(reinterpret_cast<char *>(vec->data() + *pos), str.c_str());
@@ -155,12 +156,18 @@ static bool grallocDecodeBufferDescriptor(const hidl_vec<vecT> &androidDescripto
 	size_t pos = 0;
 
 	if (((DESCRIPTOR_32BIT_FIELDS * sizeof(uint32_t) / sizeof(vecT)) +
-	     (DESCRIPTOR_64BIT_FIELDS * sizeof(uint64_t) / sizeof(vecT))) > androidDescriptor.size())
+	     (DESCRIPTOR_64BIT_FIELDS * sizeof(uint64_t) / sizeof(vecT))) +
+	     sizeof('\0') > androidDescriptor.size())
 	{
 		MALI_GRALLOC_LOGE("Descriptor is too small");
 		return false;
 	}
 
+	if (static_cast<char>(androidDescriptor[androidDescriptor.size() - 1]) != '\0') {
+		MALI_GRALLOC_LOGE("Descriptor does not contain an ending null character");
+		return false;
+	}
+
 	if (pop_descriptor_uint32(androidDescriptor, &pos) != HIDL_MAPPER_VERSION_SCALED / 10)
 	{
 		MALI_GRALLOC_LOGE("Corrupted buffer version in descriptor = %p, pid = %d ", &androidDescriptor, getpid());
diff --git a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
index a155519..ac3fc93 100644
--- a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
+++ b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
@@ -45,8 +45,7 @@ using android::hardware::graphics::mapper::V4_0::Error;
 // libraries and should depend upon HAL (and it's extension) to call into
 // Gralloc.
 int mali_gralloc_reference_validate(buffer_handle_t handle) {
-	auto hnd = static_cast<const private_handle_t *>(handle);
-  return private_handle_t::validate(hnd);
+	return private_handle_t::validate(handle);
 }
 
 const private_handle_t * convertNativeHandleToPrivateHandle(buffer_handle_t handle) {
@@ -70,7 +69,7 @@ android::sp<IMapper> get_mapper() {
 
 int VendorGraphicBufferMeta::get_video_metadata_fd(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return -EINVAL;
@@ -136,7 +135,7 @@ int VendorGraphicBufferMeta::set_dataspace(buffer_handle_t hnd, android_dataspac
 
 int VendorGraphicBufferMeta::is_afbc(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -147,11 +146,9 @@ int VendorGraphicBufferMeta::is_afbc(buffer_handle_t hnd)
 	return 0;
 }
 
-int VendorGraphicBufferMeta::is_sbwc(buffer_handle_t buffer_hnd_p)
+int VendorGraphicBufferMeta::is_sbwc(buffer_handle_t hnd)
 {
-	const private_handle_t *hnd = static_cast<const private_handle_t *>(buffer_hnd_p);
-
-	return is_sbwc_format(static_cast<uint32_t>(hnd->alloc_format & MALI_GRALLOC_INTFMT_FMT_MASK));
+	return is_sbwc_format(VendorGraphicBufferMeta::get_internal_format(hnd));
 }
 
 #define GRALLOC_META_GETTER(__type__, __name__, __member__) \
@@ -165,7 +162,8 @@ __type__ VendorGraphicBufferMeta::get_##__name__(buffer_handle_t hnd) \
 
 uint32_t VendorGraphicBufferMeta::get_format(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
+
 	if (!gralloc_hnd)
 		return 0;
 
@@ -174,7 +172,8 @@ uint32_t VendorGraphicBufferMeta::get_format(buffer_handle_t hnd)
 
 uint64_t VendorGraphicBufferMeta::get_internal_format(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);;
+
 	if (!gralloc_hnd)
 		return 0;
 
@@ -196,7 +195,7 @@ GRALLOC_META_GETTER(uint64_t, flags, flags);
 
 int VendorGraphicBufferMeta::get_fd(buffer_handle_t hnd, int num)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return -1;
@@ -209,7 +208,7 @@ int VendorGraphicBufferMeta::get_fd(buffer_handle_t hnd, int num)
 
 int VendorGraphicBufferMeta::get_size(buffer_handle_t hnd, int num)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -223,7 +222,7 @@ int VendorGraphicBufferMeta::get_size(buffer_handle_t hnd, int num)
 
 uint64_t VendorGraphicBufferMeta::get_usage(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -257,7 +256,7 @@ void* VendorGraphicBufferMeta::get_video_metadata_roiinfo(buffer_handle_t hnd)
 
 void VendorGraphicBufferMeta::init(const buffer_handle_t handle)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(handle);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(handle);
 
 	if (!gralloc_hnd)
 		return;