Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 05:49:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

media.bufferpool2: ensure message-ids are safe from overflow/underflow

Browse Source 
Since message-ids can be wrapped, they are not safe from
overflow/underflow. Change them to be safe from overflow/underflow.

Bug: 321674574
Change-Id: I39a4baf057fc81389925e0fe358894f62ade9423
This commit is contained in:
Sungtak Lee
2024-02-27 19:49:29 +00:00
parent e2955b27df
commit a60689cd50
2 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
media/bufferpool/aidl/default/BufferPool.cpp
View File

@@ -102,11 +102,11 @@ void BufferPool::Invalidation::onBufferInvalidated(
if (it->isInvalidated(bufferId)) {
uint32_t msgId = 0;
if (it->mNeedsAck) {
msgId = ++mInvalidationId;
if (msgId == 0) {
// wrap happens
msgId = ++mInvalidationId;
if (mInvalidationId == UINT_MAX) {
// wrap happens;
mInvalidationId = 0;
}
msgId = ++mInvalidationId;
}
channel.postInvalidation(msgId, it->mFrom, it->mTo);
it = mPendings.erase(it);
@@ -125,11 +125,11 @@ void BufferPool::Invalidation::onInvalidationRequest(
const std::shared_ptr<Accessor> &impl) {
uint32_t msgId = 0;
if (needsAck) {
msgId = ++mInvalidationId;
if (msgId == 0) {
// wrap happens
msgId = ++mInvalidationId;
if (mInvalidationId == UINT_MAX) {
//wrap happens
mInvalidationId = 0;
}
msgId = ++mInvalidationId;
}
ALOGV("bufferpool2 invalidation requested and queued");
if (left == 0) {

11
media/bufferpool/aidl/default/BufferStatus.cpp
View File

@@ -26,8 +26,17 @@ namespace aidl::android::hardware::media::bufferpool2::implementation {
using aidl::android::hardware::media::bufferpool2::BufferStatus;
uint32_t wrappedMinus(uint32_t a, uint32_t b) {
if (a >= b) {
return a - b;
} else {
return ~(b - a) + 1;
}
}
bool isMessageLater(uint32_t curMsgId, uint32_t prevMsgId) {
return curMsgId != prevMsgId && curMsgId - prevMsgId < prevMsgId - curMsgId;
return curMsgId != prevMsgId &&
wrappedMinus(curMsgId, prevMsgId) < wrappedMinus(prevMsgId, curMsgId);
}
bool isBufferInRange(BufferId from, BufferId to, BufferId bufferId) {