diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2018-08-10 20:33:04 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-08-10 20:33:04 +0000 |
commit | d1f02ecaa5fb454c8b6aa8e77b8a4032432f3f2c (patch) | |
tree | ee957b9b56a36169a1a9fc103c24d7342fa47ffd | |
parent | 36b2210b5c7ac4113e4e03998929a767f315531a (diff) | |
parent | d0ed957c07c6ad4ff352fd4d32a88fe550c3230e (diff) | |
download | media-oreo-m6-s4-release.tar.gz |
Merge cherrypicks of [4741663, 4741664, 4741665, 4741666, 4743080, 4743081, 4743082, 4743083, 4741262, 4741263, 4741264, 4741265, 4741266, 4741667, 4743084, 4741242, 4741243, 4741741, 4741742, 4741743, 4741744, 4741822, 4743085, 4741668, 4741338, 4743055, 4743056, 4743070, 4743073, 4743075, 4743076, 4743078, 4743079, 4743161, 4743162, 4743164, 4743165, 4743167, 4743168, 4743169, 4743170, 4741681, 4741682, 4741683, 4741684, 4741685, 4741686, 4741687, 4741688, 4741689, 4741690, 4741691, 4741692, 4741693, 4741694, 4741695, 4741696, 4741697, 4741698, 4741699, 4743240, 4743241, 4743242, 4743243, 4741745, 4741823, 4741824, 4741825, 4741267, 4741268, 4743244, 4743280, 4743281, 4743224, 4743203, 4743204, 4743205, 4741746, 4741747, 4743245, 4741826, 4741827, 4741828, 4741829, 4741748, 4741749, 4741750, 4743233, 4743282, 4741244, 4741245, 4741246, 4741247, 4743206, 4743207, 4743208, 4743209, 4743210, 4743211, 4743212, 4743213, 4743214, 4743215, 4743216, 4743217, 4743218, 4743219, 4743360, 4743361, 4743362, 4743363, 4743364, 4743365, 4743366, 4743367, 4743368, 4743369, 4743370, 4743371, 4743372, 4743373, 4743374, 4743375, 4743376, 4743377, 4743283, 4743284, 4741830, 4742501, 4743246, 4743086, 4743087, 4743378, 4743379, 4741751] into sparse-4749909-L04200000199131547android-8.1.0_r52android-8.1.0_r50android-8.1.0_r47android-8.1.0_r46oreo-m7-releaseoreo-m6-s4-release
Change-Id: If8d1962e33a9acde863d9cde08bd9c6e7cf49267
6 files changed, 84 insertions, 22 deletions
diff --git a/msm8974/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h b/msm8974/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h index e3f5d8e..51440c9 100644 --- a/msm8974/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h +++ b/msm8974/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010 - 2014, The Linux Foundation. All rights reserved. +Copyright (c) 2010 - 2014, 2018, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -1095,7 +1095,7 @@ class omx_vdec: public qc_omx_component } static OMX_ERRORTYPE describeColorFormat(OMX_PTR params); - + bool m_buffer_error; }; #ifdef _MSM8974_ diff --git a/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp index 8b34951..811f9d7 100644 --- a/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp +++ b/msm8974/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010 - 2016, The Linux Foundation. All rights reserved. +Copyright (c) 2010 - 2016, 2018, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -596,7 +596,8 @@ omx_vdec::omx_vdec(): m_error_propogated(false), client_set_fps(false), m_last_rendered_TS(-1), m_queued_codec_config_count(0), - secure_scaling_to_non_secure_opb(false) + secure_scaling_to_non_secure_opb(false), + m_buffer_error(false) { /* Assumption is that , to begin with , we have all the frames with decoder */ DEBUG_PRINT_HIGH("In %u bit OMX vdec Constructor", (unsigned int)sizeof(long) * 8); @@ -4732,6 +4733,7 @@ OMX_ERRORTYPE omx_vdec::use_output_buffer( eRet = allocate_output_headers(); if (eRet == OMX_ErrorNone) eRet = allocate_extradata(); + output_use_buffer = true; } if (eRet == OMX_ErrorNone) { @@ -5147,7 +5149,6 @@ OMX_ERRORTYPE omx_vdec::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr) index = bufferHdr - m_inp_mem_ptr; DEBUG_PRINT_LOW("Free Input Buffer index = %d",index); - auto_lock l(buf_lock); bufferHdr->pInputPortPrivate = NULL; if (index < drv_ctx.ip_buf.actualcount && drv_ctx.ptr_inputbuffer) { @@ -5348,11 +5349,13 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( unsigned i = 0; unsigned char *buf_addr = NULL; int pmem_fd = -1; + unsigned int align_size = 0; (void) hComp; (void) port; + if (bytes != drv_ctx.ip_buf.buffer_size) { DEBUG_PRINT_LOW("Requested Size is wrong %u epected is %u", (unsigned int)bytes, (unsigned int)drv_ctx.ip_buf.buffer_size); @@ -5407,8 +5410,10 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( int rc; DEBUG_PRINT_LOW("Allocate input Buffer"); #ifdef USE_ION + align_size = drv_ctx.ip_buf.buffer_size + 512; + align_size = (align_size + drv_ctx.ip_buf.alignment - 1)&(~(drv_ctx.ip_buf.alignment - 1)); drv_ctx.ip_buf_ion_info[i].ion_device_fd = alloc_map_ion_memory( - drv_ctx.ip_buf.buffer_size,drv_ctx.op_buf.alignment, + align_size, drv_ctx.op_buf.alignment, &drv_ctx.ip_buf_ion_info[i].ion_alloc_data, &drv_ctx.ip_buf_ion_info[i].fd_ion_data, secure_mode ? ION_SECURE #ifndef DISABLE_INPUT_BUFFER_CACHE @@ -5907,6 +5912,10 @@ OMX_ERRORTYPE omx_vdec::allocate_buffer(OMX_IN OMX_HANDLETYPE hC eRet = allocate_input_buffer(hComp,bufferHdr,port,appData,bytes); } } else if (port == OMX_CORE_OUTPUT_PORT_INDEX) { + if (output_use_buffer) { + DEBUG_PRINT_ERROR("Allocate output buffer not allowed after use buffer"); + return OMX_ErrorBadParameter; + } eRet = client_buffers.allocate_buffers_color_convert(hComp,bufferHdr,port, appData,bytes); } else { @@ -5967,6 +5976,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, (void) hComp; DEBUG_PRINT_LOW("In for decoder free_buffer"); + auto_lock l(buf_lock); if (m_state == OMX_StateIdle && (BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) { DEBUG_PRINT_LOW(" free buffer while Component in Loading pending"); @@ -5983,7 +5993,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, post_event(OMX_EventError, OMX_ErrorPortUnpopulated, OMX_COMPONENT_GENERATE_EVENT); - + m_buffer_error = true; return OMX_ErrorIncorrectStateOperation; } else if (m_state != OMX_StateInvalid) { DEBUG_PRINT_ERROR("Invalid state to free buffer,port lost Buffers"); @@ -5991,7 +6001,6 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, OMX_ErrorPortUnpopulated, OMX_COMPONENT_GENERATE_EVENT); } - if (port == OMX_CORE_INPUT_PORT_INDEX) { /*Check if arbitrary bytes*/ if (!arbitrary_bytes && !input_use_buffer) @@ -6088,6 +6097,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, BITMASK_CLEAR((&m_flags),OMX_COMPONENT_LOADING_PENDING); post_event(OMX_CommandStateSet, OMX_StateLoaded, OMX_COMPONENT_GENERATE_EVENT); + m_buffer_error = false; } } return eRet; @@ -6261,6 +6271,11 @@ OMX_ERRORTYPE omx_vdec::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp, if (!temp_buffer || (temp_buffer - drv_ctx.ptr_inputbuffer) > (int)drv_ctx.ip_buf.actualcount) { return OMX_ErrorBadParameter; } + + if (BITMASK_ABSENT(&m_inp_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("ETBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } /* If its first frame, H264 codec and reject is true, then parse the nal and get the profile. Based on this, reject the clip playback */ if (first_frame == 0 && codec_type_parse == CODEC_TYPE_H264 && @@ -6550,6 +6565,7 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( struct vdec_bufferpayload *ptr_outputbuffer = NULL; struct vdec_output_frameinfo *ptr_respbuffer = NULL; + auto_lock l(buf_lock); nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr()); if (!bufferAdd || !bufferAdd->pBuffer || nPortIndex >= drv_ctx.op_buf.actualcount) { @@ -6558,6 +6574,10 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( return OMX_ErrorBadParameter; } + if (BITMASK_ABSENT(&m_out_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("FTBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } DEBUG_PRINT_LOW("FTBProxy: bufhdr = %p, bufhdr->pBuffer = %p", bufferAdd, bufferAdd->pBuffer); /*Return back the output buffer to client*/ @@ -7743,7 +7763,7 @@ int omx_vdec::async_message_process (void *context, void* message) output_respbuf->pic_type = PICTURE_TYPE_B; } - if (omx->output_use_buffer) + if (!omx->m_enable_android_native_buffers && omx->output_use_buffer) memcpy ( omxhdr->pBuffer, (void *) ((unsigned long)vdec_msg->msgdata.output_frame.bufferaddr + (unsigned long)vdec_msg->msgdata.output_frame.offset), diff --git a/msm8996/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h b/msm8996/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h index b5807cc..faaf0cc 100644 --- a/msm8996/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h +++ b/msm8996/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010 - 2016, The Linux Foundation. All rights reserved. +Copyright (c) 2010 - 2016, 2018, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -1189,6 +1189,7 @@ class omx_vdec: public qc_omx_component // list of extensions is not mutable after initialization const VendorExtensionStore mVendorExtensionStore; + bool m_buffer_error; }; #ifdef _MSM8974_ diff --git a/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp b/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp index b2ca45c..06fdde3 100644 --- a/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp +++ b/msm8996/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010 - 2016, The Linux Foundation. All rights reserved. +Copyright (c) 2010 - 2016, 2018, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -648,7 +648,8 @@ omx_vdec::omx_vdec(): m_error_propogated(false), m_queued_codec_config_count(0), current_perf_level(V4L2_CID_MPEG_VIDC_PERF_LEVEL_NOMINAL), secure_scaling_to_non_secure_opb(false), - m_force_compressed_for_dpb(false) + m_force_compressed_for_dpb(false), + m_buffer_error(false) { m_pipe_in = -1; m_pipe_out = -1; @@ -5572,6 +5573,7 @@ OMX_ERRORTYPE omx_vdec::use_output_buffer( eRet = allocate_output_headers(); if (eRet == OMX_ErrorNone) eRet = allocate_extradata(); + output_use_buffer = true; } if (eRet == OMX_ErrorNone) { @@ -5994,7 +5996,6 @@ OMX_ERRORTYPE omx_vdec::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr) index = bufferHdr - m_inp_mem_ptr; DEBUG_PRINT_LOW("Free Input Buffer index = %d",index); - auto_lock l(buf_lock); bufferHdr->pInputPortPrivate = NULL; if (index < drv_ctx.ip_buf.actualcount && drv_ctx.ptr_inputbuffer) { @@ -6203,6 +6204,7 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( unsigned i = 0; unsigned char *buf_addr = NULL; int pmem_fd = -1; + unsigned int align_size = 0; (void) hComp; (void) port; @@ -6262,8 +6264,10 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( int rc; DEBUG_PRINT_LOW("Allocate input Buffer"); #ifdef USE_ION + align_size = drv_ctx.ip_buf.buffer_size + 512; + align_size = (align_size + drv_ctx.ip_buf.alignment - 1)&(~(drv_ctx.ip_buf.alignment - 1)); drv_ctx.ip_buf_ion_info[i].ion_device_fd = alloc_map_ion_memory( - drv_ctx.ip_buf.buffer_size,drv_ctx.op_buf.alignment, + align_size, drv_ctx.op_buf.alignment, &drv_ctx.ip_buf_ion_info[i].ion_alloc_data, &drv_ctx.ip_buf_ion_info[i].fd_ion_data, secure_mode ? SECURE_FLAGS_INPUT_BUFFER : ION_FLAG_CACHED); @@ -6751,6 +6755,10 @@ OMX_ERRORTYPE omx_vdec::allocate_buffer(OMX_IN OMX_HANDLETYPE hC eRet = allocate_input_buffer(hComp,bufferHdr,port,appData,bytes); } } else if (port == OMX_CORE_OUTPUT_PORT_INDEX) { + if (output_use_buffer) { + DEBUG_PRINT_ERROR("Allocate output buffer not allowed after use buffer"); + return OMX_ErrorBadParameter; + } eRet = client_buffers.allocate_buffers_color_convert(hComp,bufferHdr,port, appData,bytes); } else { @@ -6811,6 +6819,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, (void) hComp; DEBUG_PRINT_LOW("In for decoder free_buffer"); + auto_lock l(buf_lock); if (m_state == OMX_StateIdle && (BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) { DEBUG_PRINT_LOW(" free buffer while Component in Loading pending"); @@ -6827,7 +6836,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, post_event(OMX_EventError, OMX_ErrorPortUnpopulated, OMX_COMPONENT_GENERATE_EVENT); - + m_buffer_error = true; return OMX_ErrorIncorrectStateOperation; } else if (m_state != OMX_StateInvalid) { DEBUG_PRINT_ERROR("Invalid state to free buffer,port lost Buffers"); @@ -6932,6 +6941,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, BITMASK_CLEAR((&m_flags),OMX_COMPONENT_LOADING_PENDING); post_event(OMX_CommandStateSet, OMX_StateLoaded, OMX_COMPONENT_GENERATE_EVENT); + m_buffer_error = false; } } return eRet; @@ -7101,6 +7111,11 @@ OMX_ERRORTYPE omx_vdec::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp, if (!temp_buffer || (temp_buffer - drv_ctx.ptr_inputbuffer) > (int)drv_ctx.ip_buf.actualcount) { return OMX_ErrorBadParameter; } + + if (BITMASK_ABSENT(&m_inp_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("ETBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } /* If its first frame, H264 codec and reject is true, then parse the nal and get the profile. Based on this, reject the clip playback */ if (first_frame == 0 && codec_type_parse == CODEC_TYPE_H264 && @@ -7390,6 +7405,7 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( struct vdec_bufferpayload *ptr_outputbuffer = NULL; struct vdec_output_frameinfo *ptr_respbuffer = NULL; + auto_lock l(buf_lock); nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr()); if (bufferAdd == NULL || nPortIndex >= drv_ctx.op_buf.actualcount) { @@ -7398,6 +7414,10 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( return OMX_ErrorBadParameter; } + if (BITMASK_ABSENT(&m_out_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("FTBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } DEBUG_PRINT_LOW("FTBProxy: bufhdr = %p, bufhdr->pBuffer = %p", bufferAdd, bufferAdd->pBuffer); /*Return back the output buffer to client*/ @@ -8671,7 +8691,7 @@ int omx_vdec::async_message_process (void *context, void* message) if (omxhdr && omxhdr->nFilledLen) { omx->request_perf_level(VIDC_NOMINAL); } - if (omx->output_use_buffer && omxhdr->pBuffer && + if (!omx->m_enable_android_native_buffers && omx->output_use_buffer && omxhdr->pBuffer && vdec_msg->msgdata.output_frame.bufferaddr) memcpy ( omxhdr->pBuffer, (void *) ((unsigned long)vdec_msg->msgdata.output_frame.bufferaddr + diff --git a/msm8998/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h b/msm8998/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h index 8ae35a4..c0660fd 100644 --- a/msm8998/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h +++ b/msm8998/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h @@ -1,5 +1,5 @@ /*-------------------------------------------------------------------------- -Copyright (c) 2010 - 2017, The Linux Foundation. All rights reserved. +Copyright (c) 2010 - 2018, The Linux Foundation. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -1286,6 +1286,7 @@ class omx_vdec: public qc_omx_component // list of extensions is not mutable after initialization const VendorExtensionStore mVendorExtensionStore; + bool m_buffer_error; }; #ifdef _MSM8974_ diff --git a/msm8998/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp b/msm8998/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp index a973998..f25cc48 100644 --- a/msm8998/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp +++ b/msm8998/mm-video-v4l2/vidc/vdec/src/omx_vdec_v4l2.cpp @@ -667,7 +667,8 @@ omx_vdec::omx_vdec(): m_error_propogated(false), current_perf_level(V4L2_CID_MPEG_VIDC_PERF_LEVEL_NOMINAL), secure_scaling_to_non_secure_opb(false), m_force_compressed_for_dpb(true), - m_is_display_session(false) + m_is_display_session(false), + m_buffer_error(false) { m_pipe_in = -1; m_pipe_out = -1; @@ -5995,6 +5996,7 @@ OMX_ERRORTYPE omx_vdec::use_output_buffer( eRet = allocate_output_headers(); if (eRet == OMX_ErrorNone) eRet = allocate_extradata(); + output_use_buffer = true; } if (eRet == OMX_ErrorNone) { @@ -6504,7 +6506,6 @@ OMX_ERRORTYPE omx_vdec::free_input_buffer(OMX_BUFFERHEADERTYPE *bufferHdr) index = bufferHdr - m_inp_mem_ptr; DEBUG_PRINT_LOW("Free Input Buffer index = %d",index); - auto_lock l(buf_lock); bufferHdr->pInputPortPrivate = NULL; if (index < drv_ctx.ip_buf.actualcount && drv_ctx.ptr_inputbuffer) { @@ -6730,6 +6731,7 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( unsigned i = 0; unsigned char *buf_addr = NULL; int pmem_fd = -1; + unsigned int align_size = 0; (void) hComp; (void) port; @@ -6789,8 +6791,10 @@ OMX_ERRORTYPE omx_vdec::allocate_input_buffer( int rc; DEBUG_PRINT_LOW("Allocate input Buffer"); #ifdef USE_ION + align_size = drv_ctx.ip_buf.buffer_size + 512; + align_size = (align_size + drv_ctx.ip_buf.alignment - 1)&(~(drv_ctx.ip_buf.alignment - 1)); drv_ctx.ip_buf_ion_info[i].ion_device_fd = alloc_map_ion_memory( - drv_ctx.ip_buf.buffer_size,drv_ctx.op_buf.alignment, + align_size, drv_ctx.op_buf.alignment, &drv_ctx.ip_buf_ion_info[i].ion_alloc_data, &drv_ctx.ip_buf_ion_info[i].fd_ion_data, secure_mode ? SECURE_FLAGS_INPUT_BUFFER : 0); @@ -7346,6 +7350,10 @@ OMX_ERRORTYPE omx_vdec::allocate_buffer(OMX_IN OMX_HANDLETYPE hC eRet = allocate_input_buffer(hComp,bufferHdr,port,appData,bytes); } } else if (port == OMX_CORE_OUTPUT_PORT_INDEX) { + if (output_use_buffer) { + DEBUG_PRINT_ERROR("Allocate output buffer not allowed after use buffer"); + return OMX_ErrorBadParameter; + } eRet = client_buffers.allocate_buffers_color_convert(hComp,bufferHdr,port, appData,bytes); } else { @@ -7406,6 +7414,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, (void) hComp; DEBUG_PRINT_LOW("In for decoder free_buffer"); + auto_lock l(buf_lock); if (m_state == OMX_StateIdle && (BITMASK_PRESENT(&m_flags ,OMX_COMPONENT_LOADING_PENDING))) { DEBUG_PRINT_LOW(" free buffer while Component in Loading pending"); @@ -7422,7 +7431,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, post_event(OMX_EventError, OMX_ErrorPortUnpopulated, OMX_COMPONENT_GENERATE_EVENT); - + m_buffer_error = true; return OMX_ErrorIncorrectStateOperation; } else if (m_state != OMX_StateInvalid) { DEBUG_PRINT_ERROR("Invalid state to free buffer,port lost Buffers"); @@ -7543,6 +7552,7 @@ OMX_ERRORTYPE omx_vdec::free_buffer(OMX_IN OMX_HANDLETYPE hComp, BITMASK_CLEAR((&m_flags),OMX_COMPONENT_LOADING_PENDING); post_event(OMX_CommandStateSet, OMX_StateLoaded, OMX_COMPONENT_GENERATE_EVENT); + m_buffer_error = false; } } return eRet; @@ -7714,6 +7724,11 @@ OMX_ERRORTYPE omx_vdec::empty_this_buffer_proxy(OMX_IN OMX_HANDLETYPE hComp, if (!temp_buffer || (temp_buffer - drv_ctx.ptr_inputbuffer) > (int)drv_ctx.ip_buf.actualcount) { return OMX_ErrorBadParameter; } + + if (BITMASK_ABSENT(&m_inp_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("ETBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } /* If its first frame, H264 codec and reject is true, then parse the nal and get the profile. Based on this, reject the clip playback */ if (first_frame == 0 && codec_type_parse == CODEC_TYPE_H264 && @@ -8015,6 +8030,7 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( struct vdec_bufferpayload *ptr_outputbuffer = NULL; struct vdec_output_frameinfo *ptr_respbuffer = NULL; + auto_lock l(buf_lock); nPortIndex = buffer-((OMX_BUFFERHEADERTYPE *)client_buffers.get_il_buf_hdr()); if (bufferAdd == NULL || nPortIndex >= drv_ctx.op_buf.actualcount) { @@ -8023,6 +8039,10 @@ OMX_ERRORTYPE omx_vdec::fill_this_buffer_proxy( return OMX_ErrorBadParameter; } + if (BITMASK_ABSENT(&m_out_bm_count, nPortIndex) || m_buffer_error) { + DEBUG_PRINT_ERROR("FTBProxy: ERROR: invalid buffer, nPortIndex %u", nPortIndex); + return OMX_ErrorBadParameter; + } DEBUG_PRINT_LOW("FTBProxy: bufhdr = %p, bufhdr->pBuffer = %p", bufferAdd, bufferAdd->pBuffer); /*Return back the output buffer to client*/ @@ -9412,7 +9432,7 @@ int omx_vdec::async_message_process (void *context, void* message) if (omxhdr && omxhdr->nFilledLen && !omx->m_need_turbo) { omx->request_perf_level(VIDC_NOMINAL); } - if (omx->output_use_buffer && omxhdr->pBuffer && + if (!omx->m_enable_android_native_buffers && omx->output_use_buffer && omxhdr->pBuffer && vdec_msg->msgdata.output_frame.bufferaddr) memcpy ( omxhdr->pBuffer, (void *) ((unsigned long)vdec_msg->msgdata.output_frame.bufferaddr + |