part of fix for [2363506] [Sapphire] Video playback broken
make sure to reject incompatible buffers in special function GRALLOC_MODULE_PERFORM_CREATE_HANDLE_FROM_BUFFER we use ioctl(PMEM_GET_SIZE) to validate that the given buffer is indeed a pmem buffer.
This commit is contained in:
		
							
								
								
									
										10
									
								
								mapper.cpp
									
									
									
									
									
								
							
							
						
						
									
										10
									
								
								mapper.cpp
									
									
									
									
									
								
							@@ -24,6 +24,7 @@
 | 
			
		||||
#include <sys/mman.h>
 | 
			
		||||
#include <sys/stat.h>
 | 
			
		||||
#include <sys/types.h>
 | 
			
		||||
#include <sys/ioctl.h>
 | 
			
		||||
 | 
			
		||||
#include <cutils/log.h>
 | 
			
		||||
#include <cutils/atomic.h>
 | 
			
		||||
@@ -31,6 +32,8 @@
 | 
			
		||||
#include <hardware/hardware.h>
 | 
			
		||||
#include <hardware/gralloc.h>
 | 
			
		||||
 | 
			
		||||
#include <linux/android_pmem.h>
 | 
			
		||||
 | 
			
		||||
#include "gralloc_priv.h"
 | 
			
		||||
 | 
			
		||||
 | 
			
		||||
@@ -301,6 +304,13 @@ int gralloc_perform(struct gralloc_module_t const* module,
 | 
			
		||||
            size_t size = va_arg(args, size_t);
 | 
			
		||||
            size_t offset = va_arg(args, size_t);
 | 
			
		||||
            void* base = va_arg(args, void*);
 | 
			
		||||
 | 
			
		||||
            // validate that it's indeed a pmem buffer
 | 
			
		||||
            pmem_region region;
 | 
			
		||||
            if (ioctl(fd, PMEM_GET_SIZE, ®ion) < 0) {
 | 
			
		||||
                break;
 | 
			
		||||
            }
 | 
			
		||||
 | 
			
		||||
            native_handle_t** handle = va_arg(args, native_handle_t**);
 | 
			
		||||
            private_handle_t* hnd = (private_handle_t*)native_handle_create(
 | 
			
		||||
                    private_handle_t::sNumFds, private_handle_t::sNumInts);
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user