DO NOT MERGE mm-video-v4l2: vdec: deprecate unused config OMX_IndexVendorVideoExtraData
This config (used to set header offline) is no longer used. Remove handling
this config since it uses non-process-safe ways to pass memory pointers.
Fixes: Security Vulnerability - Segfault in MediaServer (libOmxVdec problem #2)
Bug: 27475409
Change-Id: I7a535a3da485cbe83cf4605a05f9faf70dcca42f
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index 3b84707..977aef2 100644
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -4272,110 +4272,7 @@
DEBUG_PRINT_LOW("Set Config Called");
- if (configIndex == (OMX_INDEXTYPE)OMX_IndexVendorVideoExtraData) {
- OMX_VENDOR_EXTRADATATYPE *config = (OMX_VENDOR_EXTRADATATYPE *) configData;
- DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData called");
- if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.avc") ||
- !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mvc")) {
- DEBUG_PRINT_LOW("Index OMX_IndexVendorVideoExtraData AVC");
- OMX_U32 extra_size;
- // Parsing done here for the AVC atom is definitely not generic
- // Currently this piece of code is working, but certainly
- // not tested with all .mp4 files.
- // Incase of failure, we might need to revisit this
- // for a generic piece of code.
-
- // Retrieve size of NAL length field
- // byte #4 contains the size of NAL lenght field
- nal_length = (config->pData[4] & 0x03) + 1;
-
- extra_size = 0;
- if (nal_length > 2) {
- /* Presently we assume that only one SPS and one PPS in AvC1 Atom */
- extra_size = (nal_length - 2) * 2;
- }
-
- // SPS starts from byte #6
- OMX_U8 *pSrcBuf = (OMX_U8 *) (&config->pData[6]);
- OMX_U8 *pDestBuf;
- m_vendor_config.nPortIndex = config->nPortIndex;
-
- // minus 6 --> SPS starts from byte #6
- // minus 1 --> picture param set byte to be ignored from avcatom
- m_vendor_config.nDataSize = config->nDataSize - 6 - 1 + extra_size;
- m_vendor_config.pData = (OMX_U8 *) malloc(m_vendor_config.nDataSize);
- OMX_U32 len;
- OMX_U8 index = 0;
- // case where SPS+PPS is sent as part of set_config
- pDestBuf = m_vendor_config.pData;
-
- DEBUG_PRINT_LOW("Rxd SPS+PPS nPortIndex[%u] len[%u] data[%p]",
- (unsigned int)m_vendor_config.nPortIndex,
- (unsigned int)m_vendor_config.nDataSize,
- m_vendor_config.pData);
- while (index < 2) {
- uint8 *psize;
- len = *pSrcBuf;
- len = len << 8;
- len |= *(pSrcBuf + 1);
- psize = (uint8 *) & len;
- memcpy(pDestBuf + nal_length, pSrcBuf + 2,len);
- for (unsigned int i = 0; i < nal_length; i++) {
- pDestBuf[i] = psize[nal_length - 1 - i];
- }
- //memcpy(pDestBuf,pSrcBuf,(len+2));
- pDestBuf += len + nal_length;
- pSrcBuf += len + 2;
- index++;
- pSrcBuf++; // skip picture param set
- len = 0;
- }
- } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg4") ||
- !strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.mpeg2")) {
- m_vendor_config.nPortIndex = config->nPortIndex;
- m_vendor_config.nDataSize = config->nDataSize;
- m_vendor_config.pData = (OMX_U8 *) malloc((config->nDataSize));
- memcpy(m_vendor_config.pData, config->pData,config->nDataSize);
- } else if (!strcmp(drv_ctx.kind, "OMX.qcom.video.decoder.vc1")) {
- if (m_vendor_config.pData) {
- free(m_vendor_config.pData);
- m_vendor_config.pData = NULL;
- m_vendor_config.nDataSize = 0;
- }
-
- if (((*((OMX_U32 *) config->pData)) &
- VC1_SP_MP_START_CODE_MASK) ==
- VC1_SP_MP_START_CODE) {
- DEBUG_PRINT_LOW("set_config - VC1 simple/main profile");
- m_vendor_config.nPortIndex = config->nPortIndex;
- m_vendor_config.nDataSize = config->nDataSize;
- m_vendor_config.pData =
- (OMX_U8 *) malloc(config->nDataSize);
- memcpy(m_vendor_config.pData, config->pData,
- config->nDataSize);
- m_vc1_profile = VC1_SP_MP_RCV;
- } else if (*((OMX_U32 *) config->pData) == VC1_AP_SEQ_START_CODE) {
- DEBUG_PRINT_LOW("set_config - VC1 Advance profile");
- m_vendor_config.nPortIndex = config->nPortIndex;
- m_vendor_config.nDataSize = config->nDataSize;
- m_vendor_config.pData =
- (OMX_U8 *) malloc((config->nDataSize));
- memcpy(m_vendor_config.pData, config->pData,
- config->nDataSize);
- m_vc1_profile = VC1_AP;
- } else if ((config->nDataSize == VC1_STRUCT_C_LEN)) {
- DEBUG_PRINT_LOW("set_config - VC1 Simple/Main profile struct C only");
- m_vendor_config.nPortIndex = config->nPortIndex;
- m_vendor_config.nDataSize = config->nDataSize;
- m_vendor_config.pData = (OMX_U8*)malloc(config->nDataSize);
- memcpy(m_vendor_config.pData,config->pData,config->nDataSize);
- m_vc1_profile = VC1_SP_MP_RCV;
- } else {
- DEBUG_PRINT_LOW("set_config - Error: Unknown VC1 profile");
- }
- }
- return ret;
- } else if (configIndex == OMX_IndexConfigVideoNalSize) {
+ if (configIndex == OMX_IndexConfigVideoNalSize) {
struct v4l2_control temp;
temp.id = V4L2_CID_MPEG_VIDC_VIDEO_STREAM_FORMAT;
