added fix for broken video recording
thanks to @dragonpt for the hint Change-Id: I31d39eb1e73ad2a9cdb2f3fdcaab33118564ff9a
This commit is contained in:
parent
501e505085
commit
a13dda6831
|
@ -5,6 +5,7 @@ git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0001-libme
|
|||
git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0002-camera.patch
|
||||
git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0003-frameworks_av_fmradio_patch.patch
|
||||
git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/0001_engineering_mode_audio_settings_frameworks_av.patch
|
||||
git apply -v ../../device/mediatek/mt6753_common/patches/framework_av/frameworks_av_videorecording_fix.patch
|
||||
cd ../..
|
||||
cd frameworks/base
|
||||
git apply -v ../../device/mediatek/mt6753_common/patches/framework_base/0001-location-support-GNSS-extension-presumably-from-MTK.patch
|
||||
|
|
|
@ -0,0 +1,172 @@
|
|||
commit 3ba00da5124a1cf6d1940668e96db19b7150f7fb
|
||||
Author: Jan Engelmohr <jan.engelmohr@mailbox.tu-dresden.de>
|
||||
Date: Fri Aug 26 09:47:56 2016 +0200
|
||||
|
||||
Revert "DO NOT MERGE: Camera: Adjust pointers to ANW buffers to avoid infoleak"
|
||||
This fixes broken Video Recording for MTK chipsets after August 2016 security patch.
|
||||
|
||||
This reverts commit 998ab61981bbffd44f68faac64b47329cffda3ef.
|
||||
|
||||
Change-Id: Ifc12c57ec212a059265fade9397b6d912887f62b
|
||||
|
||||
diff --git a/camera/ICameraRecordingProxy.cpp b/camera/ICameraRecordingProxy.cpp
|
||||
index 16a3d02..7223b6d 100644
|
||||
--- a/camera/ICameraRecordingProxy.cpp
|
||||
+++ b/camera/ICameraRecordingProxy.cpp
|
||||
@@ -31,11 +31,6 @@ enum {
|
||||
RELEASE_RECORDING_FRAME,
|
||||
};
|
||||
|
||||
-uint8_t ICameraRecordingProxy::baseObject = 0;
|
||||
-
|
||||
-size_t ICameraRecordingProxy::getCommonBaseAddress() {
|
||||
- return (size_t)&baseObject;
|
||||
-}
|
||||
|
||||
class BpCameraRecordingProxy: public BpInterface<ICameraRecordingProxy>
|
||||
{
|
||||
@@ -111,3 +106,4 @@ status_t BnCameraRecordingProxy::onTransact(
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
}; // namespace android
|
||||
+
|
||||
diff --git a/include/camera/ICameraRecordingProxy.h b/include/camera/ICameraRecordingProxy.h
|
||||
index 4edf9cd..2aac284 100644
|
||||
--- a/include/camera/ICameraRecordingProxy.h
|
||||
+++ b/include/camera/ICameraRecordingProxy.h
|
||||
@@ -83,12 +83,6 @@ public:
|
||||
virtual status_t startRecording(const sp<ICameraRecordingProxyListener>& listener) = 0;
|
||||
virtual void stopRecording() = 0;
|
||||
virtual void releaseRecordingFrame(const sp<IMemory>& mem) = 0;
|
||||
-
|
||||
- // b/28466701
|
||||
- static size_t getCommonBaseAddress();
|
||||
- private:
|
||||
-
|
||||
- static uint8_t baseObject;
|
||||
};
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
diff --git a/include/media/stagefright/CameraSource.h b/include/media/stagefright/CameraSource.h
|
||||
index 85b841a..1fad350 100644
|
||||
--- a/include/media/stagefright/CameraSource.h
|
||||
+++ b/include/media/stagefright/CameraSource.h
|
||||
@@ -249,9 +249,6 @@ private:
|
||||
status_t checkFrameRate(const CameraParameters& params,
|
||||
int32_t frameRate);
|
||||
|
||||
- static void adjustIncomingANWBuffer(IMemory* data);
|
||||
- static void adjustOutgoingANWBuffer(IMemory* data);
|
||||
-
|
||||
void stopCameraRecording();
|
||||
status_t reset();
|
||||
|
||||
diff --git a/media/libstagefright/CameraSource.cpp b/media/libstagefright/CameraSource.cpp
|
||||
index f8c3268..006ef5e 100644
|
||||
--- a/media/libstagefright/CameraSource.cpp
|
||||
+++ b/media/libstagefright/CameraSource.cpp
|
||||
@@ -27,10 +27,8 @@
|
||||
#include <media/stagefright/MediaDefs.h>
|
||||
#include <media/stagefright/MediaErrors.h>
|
||||
#include <media/stagefright/MetaData.h>
|
||||
-#include <media/hardware/HardwareAPI.h>
|
||||
#include <camera/Camera.h>
|
||||
#include <camera/CameraParameters.h>
|
||||
-#include <camera/ICameraRecordingProxy.h>
|
||||
#include <gui/Surface.h>
|
||||
#include <utils/String8.h>
|
||||
#include <cutils/properties.h>
|
||||
@@ -824,8 +822,6 @@ void CameraSource::releaseQueuedFrames() {
|
||||
List<sp<IMemory> >::iterator it;
|
||||
while (!mFramesReceived.empty()) {
|
||||
it = mFramesReceived.begin();
|
||||
- // b/28466701
|
||||
- adjustOutgoingANWBuffer(it->get());
|
||||
releaseRecordingFrame(*it);
|
||||
mFramesReceived.erase(it);
|
||||
++mNumFramesDropped;
|
||||
@@ -847,9 +843,6 @@ void CameraSource::signalBufferReturned(MediaBuffer *buffer) {
|
||||
for (List<sp<IMemory> >::iterator it = mFramesBeingEncoded.begin();
|
||||
it != mFramesBeingEncoded.end(); ++it) {
|
||||
if ((*it)->pointer() == buffer->data()) {
|
||||
- // b/28466701
|
||||
- adjustOutgoingANWBuffer(it->get());
|
||||
-
|
||||
releaseOneRecordingFrame((*it));
|
||||
mFramesBeingEncoded.erase(it);
|
||||
++mNumFramesEncoded;
|
||||
@@ -966,10 +959,6 @@ void CameraSource::dataCallbackTimestamp(int64_t timestampUs,
|
||||
++mNumFramesReceived;
|
||||
|
||||
CHECK(data != NULL && data->size() > 0);
|
||||
-
|
||||
- // b/28466701
|
||||
- adjustIncomingANWBuffer(data.get());
|
||||
-
|
||||
mFramesReceived.push_back(data);
|
||||
int64_t timeUs = mStartTimeUs + (timestampUs - mFirstFrameTimeUs);
|
||||
mFrameTimes.push_back(timeUs);
|
||||
@@ -983,26 +972,6 @@ bool CameraSource::isMetaDataStoredInVideoBuffers() const {
|
||||
return mIsMetaDataStoredInVideoBuffers;
|
||||
}
|
||||
|
||||
-void CameraSource::adjustIncomingANWBuffer(IMemory* data) {
|
||||
- uint8_t *payload =
|
||||
- reinterpret_cast<uint8_t*>(data->pointer());
|
||||
- if (*(uint32_t*)payload == kMetadataBufferTypeGrallocSource) {
|
||||
- buffer_handle_t* pBuffer = (buffer_handle_t*)(payload + 4);
|
||||
- *pBuffer = (buffer_handle_t)((uint8_t*)(*pBuffer) +
|
||||
- ICameraRecordingProxy::getCommonBaseAddress());
|
||||
- }
|
||||
-}
|
||||
-
|
||||
-void CameraSource::adjustOutgoingANWBuffer(IMemory* data) {
|
||||
- uint8_t *payload =
|
||||
- reinterpret_cast<uint8_t*>(data->pointer());
|
||||
- if (*(uint32_t*)payload == kMetadataBufferTypeGrallocSource) {
|
||||
- buffer_handle_t* pBuffer = (buffer_handle_t*)(payload + 4);
|
||||
- *pBuffer = (buffer_handle_t)((uint8_t*)(*pBuffer) -
|
||||
- ICameraRecordingProxy::getCommonBaseAddress());
|
||||
- }
|
||||
-}
|
||||
-
|
||||
CameraSource::ProxyListener::ProxyListener(const sp<CameraSource>& source) {
|
||||
mSource = source;
|
||||
}
|
||||
diff --git a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
|
||||
index b7a1389..470624b 100644
|
||||
--- a/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
|
||||
+++ b/services/camera/libcameraservice/api1/client2/StreamingProcessor.cpp
|
||||
@@ -29,7 +29,6 @@
|
||||
#include <utils/Trace.h>
|
||||
#include <gui/Surface.h>
|
||||
#include <media/hardware/MetadataBufferType.h>
|
||||
-#include <camera/ICameraRecordingProxy.h>
|
||||
|
||||
#include "common/CameraDeviceBase.h"
|
||||
#include "api1/Camera2Client.h"
|
||||
@@ -769,10 +768,7 @@ status_t StreamingProcessor::processRecordingFrame() {
|
||||
uint8_t *data = (uint8_t*)heap->getBase() + offset;
|
||||
uint32_t type = kMetadataBufferTypeGrallocSource;
|
||||
*((uint32_t*)data) = type;
|
||||
- buffer_handle_t* pBuffer = (buffer_handle_t*)(data + 4);
|
||||
- *pBuffer = (buffer_handle_t)(
|
||||
- (uint8_t*)imgBuffer.mGraphicBuffer->handle -
|
||||
- ICameraRecordingProxy::getCommonBaseAddress());
|
||||
+ *((buffer_handle_t*)(data + 4)) = imgBuffer.mGraphicBuffer->handle;
|
||||
ALOGVV("%s: Camera %d: Sending out buffer_handle_t %p",
|
||||
__FUNCTION__, mId,
|
||||
imgBuffer.mGraphicBuffer->handle);
|
||||
@@ -818,10 +814,8 @@ void StreamingProcessor::releaseRecordingFrame(const sp<IMemory>& mem) {
|
||||
}
|
||||
|
||||
// Release the buffer back to the recording queue
|
||||
- // b/28466701
|
||||
- buffer_handle_t* pBuffer = (buffer_handle_t*)(data + 4);
|
||||
- buffer_handle_t imgHandle = (buffer_handle_t)((uint8_t*)(*pBuffer) +
|
||||
- ICameraRecordingProxy::getCommonBaseAddress());
|
||||
+
|
||||
+ buffer_handle_t imgHandle = *(buffer_handle_t*)(data + 4);
|
||||
|
||||
size_t itemIndex;
|
||||
for (itemIndex = 0; itemIndex < mRecordingBuffers.size(); itemIndex++) {
|
Loading…
Reference in New Issue