commit 822f8948d526d1cee0810f0a8b08fb5d20dbebb8
author Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Feb 27 19:34:27 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Feb 27 19:34:27 2020 +0000
tree 9e55f209b01d764244f7910d3b322302c8d7df67
parent b712f6d2ce004a525be77f62e46648d756077e79
parent e67575c6c40b663c9c59d104502e9fe73faf10a3

[automerger skipped] Merge "Change Context parameter to @NonNull." am: d6f68696ab am: e67575c6c4 -s ours
am skip reason: Change-Id Idaaa88719da4eac1b53a03343cc3278ea3290f35 with SHA-1 60ce9c59c7 is in history

Change-Id: I8b6ac973a6e769f0643da546c54813c736943109

src/java/android/net/rtp/AudioGroup.java

diff --git a/src/java/android/net/rtp/AudioGroup.java b/src/java/android/net/rtp/AudioGroup.java
index 697c3ab..9d96006 100644
--- a/src/java/android/net/rtp/AudioGroup.java
+++ b/src/java/android/net/rtp/AudioGroup.java
@@ -114,8 +114,7 @@
 
     /**
      * Creates an empty AudioGroup.
-     * @param context Context used to get package name. If context is null, app ops checks will
-     * fail and as a result {@link AudioStream#join(AudioGroup)} may fail.
+     * @param context Context used to get package name
      */
     public AudioGroup(@NonNull Context context) {
         mContext = context;
@@ -168,7 +167,8 @@
                 long id = nativeAdd(stream.getMode(), stream.getSocket(),
                         stream.getRemoteAddress().getHostAddress(),
                         stream.getRemotePort(), codecSpec, stream.getDtmfType(),
-                        mContext != null ? mContext.getOpPackageName() : null);
+                        mContext != null ? mContext.getOpPackageName()
+                                : ActivityThread.currentOpPackageName());
                 mStreams.put(stream, id);
             } catch (NullPointerException e) {
                 throw new IllegalStateException(e);

src/java/com/android/server/sip/SipService.java

diff --git a/src/java/com/android/server/sip/SipService.java b/src/java/com/android/server/sip/SipService.java
index 7c6daf8..ca91943 100644
--- a/src/java/com/android/server/sip/SipService.java
+++ b/src/java/com/android/server/sip/SipService.java
@@ -472,8 +472,8 @@
         mContext.enforceCallingOrSelfPermission(
                 android.Manifest.permission.USE_SIP, message);
 
-        return mAppOps.noteOp(AppOpsManager.OP_USE_SIP, Binder.getCallingUid(),
-                packageName) == AppOpsManager.MODE_ALLOWED;
+        return mAppOps.noteOp(AppOpsManager.OPSTR_USE_SIP, Binder.getCallingUid(),
+                packageName, null, message) == AppOpsManager.MODE_ALLOWED;
     }
 
     private class SipSessionGroupExt extends SipSessionAdapter {

src/jni/rtp/Android.bp

diff --git a/src/jni/rtp/Android.bp b/src/jni/rtp/Android.bp
index c938224..b6c8588 100644
--- a/src/jni/rtp/Android.bp
+++ b/src/jni/rtp/Android.bp
@@ -28,6 +28,7 @@
     ],
     header_libs: [
         "libmedia_headers",
+        "libmediametrics_headers",
     ],
 
     shared_libs: [

src/jni/rtp/AudioGroup.cpp

diff --git a/src/jni/rtp/AudioGroup.cpp b/src/jni/rtp/AudioGroup.cpp
index 0c97f9f..8bb543c 100644
--- a/src/jni/rtp/AudioGroup.cpp
+++ b/src/jni/rtp/AudioGroup.cpp
@@ -410,20 +410,29 @@
         sockaddr_storage remote;
         socklen_t addrlen = sizeof(remote);
 
-        int length = recvfrom(mSocket, buffer, sizeof(buffer),
+        int bufferSize = sizeof(buffer);
+        int length = recvfrom(mSocket, buffer, bufferSize,
             MSG_TRUNC | MSG_DONTWAIT, (sockaddr *)&remote, &addrlen);
 
         // Do we need to check SSRC, sequence, and timestamp? They are not
         // reliable but at least they can be used to identify duplicates?
-        if (length < 12 || length > (int)sizeof(buffer) ||
+        if (length < 12 || length > bufferSize ||
             (ntohl(*(uint32_t *)buffer) & 0xC07F0000) != mCodecMagic) {
             ALOGV("stream[%d] malformed packet", mSocket);
             return;
         }
         int offset = 12 + ((buffer[0] & 0x0F) << 2);
+        if (offset+2 >= bufferSize) {
+            ALOGV("invalid buffer offset: %d", offset+2);
+            return;
+        }
         if ((buffer[0] & 0x10) != 0) {
             offset += 4 + (ntohs(*(uint16_t *)&buffer[offset + 2]) << 2);
         }
+        if (offset >= bufferSize) {
+            ALOGV("invalid buffer offset: %d", offset);
+            return;
+        }
         if ((buffer[0] & 0x20) != 0) {
             length -= buffer[length - 1];
         }