DO NOT MERGE mm-video-v4l2: vdec: add safety checks for freeing buffers
Allow only up to 64 buffers on input/output port (since the
allocation bitmap is only 64-wide).
Do not allow changing theactual buffer count while still
holding allocation (Client can technically negotiate
buffer count on a free/disabled port)
Add safety checks to free only as many buffers were allocated.
Fixes: Security Vulnerability - Heap Overflow and Possible Local
Privilege Escalation in MediaServer (libOmxVdec problem #3)
Bug: 27532282 27661749
Change-Id: I06dd680d43feaef3efdc87311e8a6703e234b523
diff --git a/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h b/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
index 120a11d..3d8ec9e 100644
--- a/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
+++ b/mm-video-v4l2/vidc/vdec/inc/omx_vdec.h
@@ -183,7 +183,7 @@
#define DESC_BUFFER_SIZE (8192 * 16)
#ifdef _ANDROID_
-#define MAX_NUM_INPUT_OUTPUT_BUFFERS 32
+#define MAX_NUM_INPUT_OUTPUT_BUFFERS 64
#endif
#ifdef _ION_HEAP_MASK_COMPATIBILITY_WA
diff --git a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
index 977aef2..95ffb98 100644
--- a/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
+++ b/mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp
@@ -3401,10 +3401,22 @@
break;
}
- if (!client_buffers.get_buffer_req(buffer_size)) {
+ if (portDefn->nBufferCountActual > MAX_NUM_INPUT_OUTPUT_BUFFERS) {
+ DEBUG_PRINT_ERROR("Requested o/p buf count (%u) exceeds limit (%u)",
+ portDefn->nBufferCountActual, MAX_NUM_INPUT_OUTPUT_BUFFERS);
+ eRet = OMX_ErrorBadParameter;
+ } else if (!client_buffers.get_buffer_req(buffer_size)) {
DEBUG_PRINT_ERROR("Error in getting buffer requirements");
eRet = OMX_ErrorBadParameter;
} else if (!port_format_changed) {
+
+ // Buffer count can change only when port is disabled
+ if (!release_output_done()) {
+ DEBUG_PRINT_ERROR("Cannot change o/p buffer count since all buffers are not freed yet !");
+ eRet = OMX_ErrorInvalidState;
+ break;
+ }
+
if ( portDefn->nBufferCountActual >= drv_ctx.op_buf.mincount &&
portDefn->nBufferSize >= drv_ctx.op_buf.buffer_size ) {
drv_ctx.op_buf.actualcount = portDefn->nBufferCountActual;
@@ -3513,6 +3525,19 @@
eRet = OMX_ErrorBadParameter;
break;
}
+ if (portDefn->nBufferCountActual > MAX_NUM_INPUT_OUTPUT_BUFFERS) {
+ DEBUG_PRINT_ERROR("Requested i/p buf count (%u) exceeds limit (%u)",
+ portDefn->nBufferCountActual, MAX_NUM_INPUT_OUTPUT_BUFFERS);
+ eRet = OMX_ErrorBadParameter;
+ break;
+ }
+ // Buffer count can change only when port is disabled
+ if (!release_input_done()) {
+ DEBUG_PRINT_ERROR("Cannot change i/p buffer count since all buffers are not freed yet !");
+ eRet = OMX_ErrorInvalidState;
+ break;
+ }
+
if (portDefn->nBufferCountActual >= drv_ctx.ip_buf.mincount
|| portDefn->nBufferSize != drv_ctx.ip_buf.buffer_size) {
port_format_changed = true;
@@ -5882,7 +5907,8 @@
nPortIndex = buffer - m_inp_heap_ptr;
DEBUG_PRINT_LOW("free_buffer on i/p port - Port idx %d", nPortIndex);
- if (nPortIndex < drv_ctx.ip_buf.actualcount) {
+ if (nPortIndex < drv_ctx.ip_buf.actualcount &&
+ BITMASK_PRESENT(&m_inp_bm_count, nPortIndex)) {
// Clear the bit associated with it.
BITMASK_CLEAR(&m_inp_bm_count,nPortIndex);
BITMASK_CLEAR(&m_heap_inp_bm_count,nPortIndex);
@@ -5924,7 +5950,8 @@
} else if (port == OMX_CORE_OUTPUT_PORT_INDEX) {
// check if the buffer is valid
nPortIndex = buffer - client_buffers.get_il_buf_hdr();
- if (nPortIndex < drv_ctx.op_buf.actualcount) {
+ if (nPortIndex < drv_ctx.op_buf.actualcount &&
+ BITMASK_PRESENT(&m_out_bm_count, nPortIndex)) {
DEBUG_PRINT_LOW("free_buffer on o/p port - Port idx %d", nPortIndex);
// Clear the bit associated with it.
BITMASK_CLEAR(&m_out_bm_count,nPortIndex);
@@ -6576,7 +6603,14 @@
if (m_out_mem_ptr) {
DEBUG_PRINT_LOW("Freeing the Output Memory");
for (i = 0; i < drv_ctx.op_buf.actualcount; i++ ) {
- free_output_buffer (&m_out_mem_ptr[i]);
+ if (BITMASK_PRESENT(&m_out_bm_count, i)) {
+ BITMASK_CLEAR(&m_out_bm_count, i);
+ client_buffers.free_output_buffer (&m_out_mem_ptr[i]);
+ }
+
+ if (release_output_done()) {
+ break;
+ }
}
#ifdef _ANDROID_ICS_
memset(&native_buffer, 0, (sizeof(nativebuffer) * MAX_NUM_INPUT_OUTPUT_BUFFERS));
@@ -6587,11 +6621,19 @@
if (m_inp_mem_ptr || m_inp_heap_ptr) {
DEBUG_PRINT_LOW("Freeing the Input Memory");
for (i = 0; i<drv_ctx.ip_buf.actualcount; i++ ) {
- if (m_inp_mem_ptr)
- free_input_buffer (i,&m_inp_mem_ptr[i]);
- else
- free_input_buffer (i,NULL);
- }
+
+ if (BITMASK_PRESENT(&m_inp_bm_count, i)) {
+ BITMASK_CLEAR(&m_inp_bm_count, i);
+ if (m_inp_mem_ptr)
+ free_input_buffer (i,&m_inp_mem_ptr[i]);
+ else
+ free_input_buffer (i,NULL);
+ }
+
+ if (release_input_done()) {
+ break;
+ }
+ }
}
free_input_buffer_header();
free_output_buffer_header();
@@ -6993,7 +7035,7 @@
bool bRet = false;
unsigned i=0,j=0;
- DEBUG_PRINT_LOW("Value of m_out_mem_ptr %p",m_inp_mem_ptr);
+ DEBUG_PRINT_LOW("Value of m_out_mem_ptr %p",m_out_mem_ptr);
if (m_out_mem_ptr) {
for (; j < drv_ctx.op_buf.actualcount ; j++) {
if (BITMASK_PRESENT(&m_out_bm_count,j)) {
