Snap for 9470583 from f98c943a53019a0afae57dbc4459ce610f48e331 to tm-qpr3-release

Change-Id: Ie0409904f9bc9f596a8497300cc1eafd71bad135

5 files changed, 33 insertions, 32 deletions

diff --git a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
index 7656fcf..04bf7ed 100644
--- a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
+++ b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
@@ -476,7 +476,7 @@ static void update_yv12_stride(int8_t plane,
  * (matched against `VALID_USAGE`). These should be aligned.
  */
 static bool log_deprecated_usage_flags(uint64_t usage) {
-	if (usage & MALI_GRALLOC_USAGE_FRONTBUFFER) {
+	if (usage & DEPRECATED_MALI_GRALLOC_USAGE_FRONTBUFFER) {
 		MALI_GRALLOC_LOGW("Using deprecated FRONTBUFFER usage bit, please upgrade to BufferUsage::FRONT_BUFFER");
 		return true;
 	}
@@ -980,16 +980,6 @@ static int prepare_descriptor_exynos_formats(
 	return 0;
 }
 
-static bool validate_usage(const uint64_t usage) {
-	if (usage & GRALLOC_USAGE_FRONT_BUFFER) {
-		/* TODO(b/218383959): Enable front buffer rendering */
-		MALI_GRALLOC_LOGW("Front buffer rendering is disabled.");
-		return false;
-	}
-
-	return true;
-}
-
 int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescriptor)
 {
 	alloc_type_t alloc_type{};
@@ -998,11 +988,6 @@ int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescripto
 	int alloc_height = bufDescriptor->height;
 	uint64_t usage = bufDescriptor->producer_usage | bufDescriptor->consumer_usage;
 
-	if (!validate_usage(usage)) {
-		MALI_GRALLOC_LOGE("Usage flag validation failed.");
-		return -EINVAL;
-	}
-
 	/*
 	* Select optimal internal pixel format based upon
 	* usage and requested format.
diff --git a/gralloc4/src/hidl_common/Allocator.cpp b/gralloc4/src/hidl_common/Allocator.cpp
index 6ca758a..3b8e62a 100644
--- a/gralloc4/src/hidl_common/Allocator.cpp
+++ b/gralloc4/src/hidl_common/Allocator.cpp
@@ -77,7 +77,17 @@ void allocate(const buffer_descriptor_t &bufferDescriptor, uint32_t count, IAllo
 			auto hnd = const_cast<private_handle_t *>(reinterpret_cast<const private_handle_t *>(tmpBuffer));
 			hnd->imapper_version = HIDL_MAPPER_VERSION_SCALED;
 
+			// 4k is rougly 7.9 MB with one byte per pixel. We are
+			// assuming that the reserved region might be needed for
+			// dynamic HDR and that represents the largest size.
+			uint64_t max_reserved_region_size = 8ull * 1024 * 1024;
 			hnd->reserved_region_size = bufferDescriptor.reserved_size;
+			if (hnd->reserved_region_size > max_reserved_region_size) {
+				MALI_GRALLOC_LOGE("%s, Requested reserved region size (%" PRIu64 ") is larger than allowed (%" PRIu64 ")",
+						__func__, hnd->reserved_region_size, max_reserved_region_size);
+				error = Error::BAD_VALUE;
+				break;
+			}
 			hnd->attr_size = mapper::common::shared_metadata_size() + hnd->reserved_region_size;
 
 			if (hnd->get_usage() & GRALLOC_USAGE_ROIINFO)
diff --git a/gralloc4/src/hidl_common/BufferDescriptor.h b/gralloc4/src/hidl_common/BufferDescriptor.h
index abaac62..0d93811 100644
--- a/gralloc4/src/hidl_common/BufferDescriptor.h
+++ b/gralloc4/src/hidl_common/BufferDescriptor.h
@@ -104,6 +104,7 @@ static uint64_t pop_descriptor_uint64(const hidl_vec<vecT> &vec, size_t *pos)
 	return val;
 }
 
+// There can only be one string at the end of the descriptor
 static void push_descriptor_string(hidl_vec<uint8_t> *vec, size_t *pos, const std::string &str)
 {
 	strcpy(reinterpret_cast<char *>(vec->data() + *pos), str.c_str());
@@ -155,12 +156,18 @@ static bool grallocDecodeBufferDescriptor(const hidl_vec<vecT> &androidDescripto
 	size_t pos = 0;
 
 	if (((DESCRIPTOR_32BIT_FIELDS * sizeof(uint32_t) / sizeof(vecT)) +
-	     (DESCRIPTOR_64BIT_FIELDS * sizeof(uint64_t) / sizeof(vecT))) > androidDescriptor.size())
+	     (DESCRIPTOR_64BIT_FIELDS * sizeof(uint64_t) / sizeof(vecT))) +
+	     sizeof('\0') > androidDescriptor.size())
 	{
 		MALI_GRALLOC_LOGE("Descriptor is too small");
 		return false;
 	}
 
+	if (static_cast<char>(androidDescriptor[androidDescriptor.size() - 1]) != '\0') {
+		MALI_GRALLOC_LOGE("Descriptor does not contain an ending null character");
+		return false;
+	}
+
 	if (pop_descriptor_uint32(androidDescriptor, &pos) != HIDL_MAPPER_VERSION_SCALED / 10)
 	{
 		MALI_GRALLOC_LOGE("Corrupted buffer version in descriptor = %p, pid = %d ", &androidDescriptor, getpid());
diff --git a/gralloc4/src/mali_gralloc_usages.h b/gralloc4/src/mali_gralloc_usages.h
index fb3b70e..3c5a0fa 100644
--- a/gralloc4/src/mali_gralloc_usages.h
+++ b/gralloc4/src/mali_gralloc_usages.h
@@ -60,7 +60,7 @@ namespace aidl_common = aidl::android::hardware::graphics::common;
 // TODO(b/183478446): Cleanup usage flags redefinition
 typedef enum
 {
-	MALI_GRALLOC_USAGE_FRONTBUFFER = GRALLOC_USAGE_PRIVATE_12,
+	DEPRECATED_MALI_GRALLOC_USAGE_FRONTBUFFER = GRALLOC_USAGE_PRIVATE_12,
 	MALI_GRALLOC_USAGE_FORCE_BACKBUFFER = GRALLOC_USAGE_PRIVATE_13,
 	MALI_GRALLOC_USAGE_NO_AFBC = GRALLOC_USAGE_PRIVATE_1,
 	MALI_GRALLOC_USAGE_AFBC_PADDING = GRALLOC_USAGE_PRIVATE_14,
diff --git a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
index a155519..ac3fc93 100644
--- a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
+++ b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
@@ -45,8 +45,7 @@ using android::hardware::graphics::mapper::V4_0::Error;
 // libraries and should depend upon HAL (and it's extension) to call into
 // Gralloc.
 int mali_gralloc_reference_validate(buffer_handle_t handle) {
-	auto hnd = static_cast<const private_handle_t *>(handle);
-  return private_handle_t::validate(hnd);
+	return private_handle_t::validate(handle);
 }
 
 const private_handle_t * convertNativeHandleToPrivateHandle(buffer_handle_t handle) {
@@ -70,7 +69,7 @@ android::sp<IMapper> get_mapper() {
 
 int VendorGraphicBufferMeta::get_video_metadata_fd(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return -EINVAL;
@@ -136,7 +135,7 @@ int VendorGraphicBufferMeta::set_dataspace(buffer_handle_t hnd, android_dataspac
 
 int VendorGraphicBufferMeta::is_afbc(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -147,11 +146,9 @@ int VendorGraphicBufferMeta::is_afbc(buffer_handle_t hnd)
 	return 0;
 }
 
-int VendorGraphicBufferMeta::is_sbwc(buffer_handle_t buffer_hnd_p)
+int VendorGraphicBufferMeta::is_sbwc(buffer_handle_t hnd)
 {
-	const private_handle_t *hnd = static_cast<const private_handle_t *>(buffer_hnd_p);
-
-	return is_sbwc_format(static_cast<uint32_t>(hnd->alloc_format & MALI_GRALLOC_INTFMT_FMT_MASK));
+	return is_sbwc_format(VendorGraphicBufferMeta::get_internal_format(hnd));
 }
 
 #define GRALLOC_META_GETTER(__type__, __name__, __member__) \
@@ -165,7 +162,8 @@ __type__ VendorGraphicBufferMeta::get_##__name__(buffer_handle_t hnd) \
 
 uint32_t VendorGraphicBufferMeta::get_format(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
+
 	if (!gralloc_hnd)
 		return 0;
 
@@ -174,7 +172,8 @@ uint32_t VendorGraphicBufferMeta::get_format(buffer_handle_t hnd)
 
 uint64_t VendorGraphicBufferMeta::get_internal_format(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);;
+
 	if (!gralloc_hnd)
 		return 0;
 
@@ -196,7 +195,7 @@ GRALLOC_META_GETTER(uint64_t, flags, flags);
 
 int VendorGraphicBufferMeta::get_fd(buffer_handle_t hnd, int num)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return -1;
@@ -209,7 +208,7 @@ int VendorGraphicBufferMeta::get_fd(buffer_handle_t hnd, int num)
 
 int VendorGraphicBufferMeta::get_size(buffer_handle_t hnd, int num)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -223,7 +222,7 @@ int VendorGraphicBufferMeta::get_size(buffer_handle_t hnd, int num)
 
 uint64_t VendorGraphicBufferMeta::get_usage(buffer_handle_t hnd)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(hnd);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
 
 	if (!gralloc_hnd)
 		return 0;
@@ -257,7 +256,7 @@ void* VendorGraphicBufferMeta::get_video_metadata_roiinfo(buffer_handle_t hnd)
 
 void VendorGraphicBufferMeta::init(const buffer_handle_t handle)
 {
-	const private_handle_t *gralloc_hnd = static_cast<const private_handle_t *>(handle);
+	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(handle);
 
 	if (!gralloc_hnd)
 		return;