added fix for broken video recording

thanks to @dragonpt for the hint

Change-Id: I31d39eb1e73ad2a9cdb2f3fdcaab33118564ff9a

2 files changed, 173 insertions, 0 deletions

diff --git a/patches/apply-patch.sh b/patches/apply-patch.sh
index e5a476b..f944867 100644
--- a/patches/apply-patch.sh
+++ b/patches/apply-patch.sh
@@ -5,6 +5,7 @@ git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0001-libme
 git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0002-camera.patch
 git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0003-frameworks_av_fmradio_patch.patch
 git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0001_engineering_mode_audio_settings_frameworks_av.patch
+git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/frameworks_av_videorecording_fix.patch
 cd ../..
 cd frameworks/base
 git apply -v ../../device/mediatek/mt6753_common/patches/framework_base/0001-location-support-GNSS-extension-presumably-from-MTK.patch
diff --git a/patches/framework_av/frameworks_av_videorecording_fix.patch b/patches/framework_av/frameworks_av_videorecording_fix.patch
new file mode 100644
index 0000000..0bccd26
--- /dev/null
+++ b/patches/framework_av/frameworks_av_videorecording_fix.patch
@@ -0,0 +1,172 @@
+commit 3ba00da5124a1cf6d1940668e96db19b7150f7fb
+Author: Jan Engelmohr <jan.engelmohr@mailbox.tu-dresden.de>
+Date:   Fri Aug 26 09:47:56 2016 +0200
+
+    Revert "DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak"
+    This fixes broken Video Recording for MTK chipsets after August 2016 security patch.
+    
+    This reverts commit 998ab61981bbffd44f68faac64b47329cffda3ef.
+    
+    Change-Id: Ifc12c57ec212a059265fade9397b6d912887f62b
+
+diff --git a/camera/ICameraRecordingProxy.cpp b/camera/ICameraRecordingProxy.cpp
+index 16a3d02..7223b6d 100644
+--- a/camera/ICameraRecordingProxy.cpp
++++ b/camera/ICameraRecordingProxy.cpp
+@@ -31,11 +31,6 @@ enum {
+     RELEASE_RECORDING_FRAME,
+ };
+ 
+-uint8_t ICameraRecordingProxy::baseObject = 0;
+-
+-size_t ICameraRecordingProxy::getCommonBaseAddress() {
+-    return (size_t)&baseObject;
+-}
+ 
+ class BpCameraRecordingProxy: public BpInterface<ICameraRecordingProxy>
+ {
+@@ -111,3 +106,4 @@ status_t BnCameraRecordingProxy::onTransact(
+ // ----------------------------------------------------------------------------
+ 
+ }; // namespace android
++
+diff --git a/include/camera/ICameraRecordingProxy.h b/include/camera/ICameraRecordingProxy.h
+index 4edf9cd..2aac284 100644
+--- a/include/camera/ICameraRecordingProxy.h
++++ b/include/camera/ICameraRecordingProxy.h
+@@ -83,12 +83,6 @@ public:
+     virtual status_t        startRecording(const sp<ICameraRecordingProxyListener>& listener) = 0;
+     virtual void            stopRecording() = 0;
+     virtual void            releaseRecordingFrame(const sp<IMemory>& mem) = 0;
+-
+-    // b/28466701
+-    static  size_t          getCommonBaseAddress();
+-  private:
+-
+-    static  uint8_t         baseObject;
+ };
+ 
+ // ----------------------------------------------------------------------------
+diff --git a/include/media/stagefright/CameraSource.h b/include/media/stagefright/CameraSource.h
+index 85b841a..1fad350 100644
+--- a/include/media/stagefright/CameraSource.h
++++ b/include/media/stagefright/CameraSource.h
+@@ -249,9 +249,6 @@ private:
+     status_t checkFrameRate(const CameraParameters& params,
+                     int32_t frameRate);
+ 
+-    static void adjustIncomingANWBuffer(IMemory* data);
+-    static void adjustOutgoingANWBuffer(IMemory* data);
+-
+     void stopCameraRecording();
+     status_t reset();
+ 
+diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
+index f8c3268..006ef5e 100644
+--- a/media/libstagefright/CameraSource.cpp
++++ b/media/libstagefright/CameraSource.cpp
+@@ -27,10 +27,8 @@
+ #include <media/stagefright/MediaDefs.h>
+ #include <media/stagefright/MediaErrors.h>
+ #include <media/stagefright/MetaData.h>
+-#include <media/hardware/HardwareAPI.h>
+ #include <camera/Camera.h>
+ #include <camera/CameraParameters.h>
+-#include <camera/ICameraRecordingProxy.h>
+ #include <gui/Surface.h>
+ #include <utils/String8.h>
+ #include <cutils/properties.h>
+@@ -824,8 +822,6 @@ void CameraSource::releaseQueuedFrames() {
+     List<sp<IMemory> >::iterator it;
+     while (!mFramesReceived.empty()) {
+         it = mFramesReceived.begin();
+-        // b/28466701
+-        adjustOutgoingANWBuffer(it->get());
+         releaseRecordingFrame(*it);
+         mFramesReceived.erase(it);
+         ++mNumFramesDropped;
+@@ -847,9 +843,6 @@ void CameraSource::signalBufferReturned(MediaBuffer *buffer) {
+     for (List<sp<IMemory> >::iterator it = mFramesBeingEncoded.begin();
+          it != mFramesBeingEncoded.end(); ++it) {
+         if ((*it)->pointer() ==  buffer->data()) {
+-            // b/28466701
+-            adjustOutgoingANWBuffer(it->get());
+-
+             releaseOneRecordingFrame((*it));
+             mFramesBeingEncoded.erase(it);
+             ++mNumFramesEncoded;
+@@ -966,10 +959,6 @@ void CameraSource::dataCallbackTimestamp(int64_t timestampUs,
+     ++mNumFramesReceived;
+ 
+     CHECK(data != NULL && data->size() > 0);
+-
+-    // b/28466701
+-    adjustIncomingANWBuffer(data.get());
+-
+     mFramesReceived.push_back(data);
+     int64_t timeUs = mStartTimeUs + (timestampUs - mFirstFrameTimeUs);
+     mFrameTimes.push_back(timeUs);
+@@ -983,26 +972,6 @@ bool CameraSource::isMetaDataStoredInVideoBuffers() const {
+     return mIsMetaDataStoredInVideoBuffers;
+ }
+ 
+-void CameraSource::adjustIncomingANWBuffer(IMemory* data) {
+-    uint8_t *payload =
+-            reinterpret_cast<uint8_t*>(data->pointer());
+-    if (*(uint32_t*)payload == kMetadataBufferTypeGrallocSource) {
+-        buffer_handle_t* pBuffer = (buffer_handle_t*)(payload + 4);
+-        *pBuffer = (buffer_handle_t)((uint8_t*)(*pBuffer) +
+-                ICameraRecordingProxy::getCommonBaseAddress());
+-    }
+-}
+-
+-void CameraSource::adjustOutgoingANWBuffer(IMemory* data) {
+-    uint8_t *payload =
+-            reinterpret_cast<uint8_t*>(data->pointer());
+-    if (*(uint32_t*)payload == kMetadataBufferTypeGrallocSource) {
+-        buffer_handle_t* pBuffer = (buffer_handle_t*)(payload + 4);
+-        *pBuffer = (buffer_handle_t)((uint8_t*)(*pBuffer) -
+-                ICameraRecordingProxy::getCommonBaseAddress());
+-    }
+-}
+-
+ CameraSource::ProxyListener::ProxyListener(const sp<CameraSource>& source) {
+     mSource = source;
+ }
+diff --git a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
+index b7a1389..470624b 100644
+--- a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
++++ b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
+@@ -29,7 +29,6 @@
+ #include <utils/Trace.h>
+ #include <gui/Surface.h>
+ #include <media/hardware/MetadataBufferType.h>
+-#include <camera/ICameraRecordingProxy.h>
+ 
+ #include "common/CameraDeviceBase.h"
+ #include "api1/Camera2Client.h"
+@@ -769,10 +768,7 @@ status_t StreamingProcessor::processRecordingFrame() {
+         uint8_t *data = (uint8_t*)heap->getBase() + offset;
+         uint32_t type = kMetadataBufferTypeGrallocSource;
+         *((uint32_t*)data) = type;
+-        buffer_handle_t* pBuffer = (buffer_handle_t*)(data + 4);
+-        *pBuffer = (buffer_handle_t)(
+-                (uint8_t*)imgBuffer.mGraphicBuffer->handle -
+-                ICameraRecordingProxy::getCommonBaseAddress());
++        *((buffer_handle_t*)(data + 4)) = imgBuffer.mGraphicBuffer->handle;
+         ALOGVV("%s: Camera %d: Sending out buffer_handle_t %p",
+                 __FUNCTION__, mId,
+                 imgBuffer.mGraphicBuffer->handle);
+@@ -818,10 +814,8 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) {
+     }
+ 
+     // Release the buffer back to the recording queue
+-    // b/28466701
+-    buffer_handle_t* pBuffer = (buffer_handle_t*)(data + 4);
+-    buffer_handle_t imgHandle = (buffer_handle_t)((uint8_t*)(*pBuffer) +
+-            ICameraRecordingProxy::getCommonBaseAddress());
++
++    buffer_handle_t imgHandle = *(buffer_handle_t*)(data + 4);
+ 
+     size_t itemIndex;
+     for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) {