GitLab

GenericSource: return error when no track exists.

SampleIterator: make sure mSamplesPerChunk is not zero before using it as divisor.

Bug: 21657957
Bug: 23705695
Bug: 22802344
Bug: 28799341
Change-Id: I7664992ade90b935d3f255dcd43ecc2898f30b04
(cherry picked from commit 0386c91b)

Limit mediaserver using rlimit, to prevent it from bringing down the system
via the low memory killer.
Default max is 65% of total RAM, but can be customized via system property.

Bug: 28471206
Bug: 28615448
Change-Id: Ic84137435d1ef0a6883e9789a4b4f399e4283f05

Bug: 28471206
Change-Id: Id5d055d76893d6f53a2e524ff5f282d1ddca3345

bug: 28175045
Change-Id: Icee6c7eb5b761da4aa3e412fb71825508d74d38f

Report MEMORY_ALLOCATION_ERROR if pStorage->picSizeInMbs would
exceed UINT32_MAX bytes.

Bug: 28532266
Change-Id: Ia6f11efb18818afcdb5fa2a38a14f2a2d8c8447a

Bug: 28377502
Change-Id: Iad5ebfb0a9ef89f09755bb332579dbd3534f9c98

Bug: 27207275
Change-Id: I35f6bf5b407869a9479feaf1b5beef7b68d04509

Bug: 27207275
Change-Id: I4412825d1ee233d993af0a67708bea54304ff62d

28076789.

Detail: Before the original fix
(Id207f369ab7b27787d83f5d8fc48dc53ed9fcdc9) for 28076789, the
code allowed a time-to-sample table size to be 0. The change
made in that fix disallowed such situation, which in fact should
be allowed. This current patch allows it again while maintaining
the security of the previous fix.

Bug: 28288202
Bug: 28076789
Change-Id: I1c9a60c7f0cfcbd3d908f24998dde15d5136a295

excessive memory allocation.

Details:

DataSource.h
- Added function getVector() for reading from a data source into
  a Vector object, whose capacity grows only as much as needed
  (in case of EOS or reading error).
SampleTable.h
- Changed the type of mTimeToSample from uint32_t* to
  Vector<uint32_t>.
SampleTable.cpp
- In setTimeToSample, modified the code to use getVector()
  instead of readAt(). If the input source has a corrupt
  time-to-sample table size that is too big, EOS will be reached
  before the whole table is read, and the return value from
  getVector() will be false.
- Also, tightened the bound for the provided time-to-sample table
  size to guarantee that the table does not take more than
  UINT_MAX32 bytes in memory.

Bug: 28076789
Change-Id: Id207f369ab7b27787d83f5d8fc48dc53ed9fcdc9

Bug: 27855419
Change-Id: Idabedca52913ec31ea5cb6a6109ab94e3fb2badd

Bug: 27793163
Bug: 27793367
Change-Id: Iec3de8a237ee2379d87a8371c13e543878c6652c

to prevent info leak

Bug: 27855172
Change-Id: I3d33e0a9cc5cf8a758d7b0794590b09c43a24561

Bug: 27793371
Change-Id: I0fe40a4cfd0a5b488f93d3f3ba6f9495235926ac

Bug: 27833616
Change-Id: I0fd599b3da431425d89236ffdd9df423c11947c0

Bug: 27833616
Change-Id: Ic4045a3f56f53b08d0b1264b2a91b8f43e91b738

Otherwise the new size checks trip on this.

Bug: 27207275
Change-Id: I1f8f01097e3a88ff041b69279a6121be842f1766

Bug: 27833616
Change-Id: I1ccdd16a00741da072527a6d13e87fd7c7fe8c54
(cherry picked from commit f9419f5fed9768c4790db35adbfd02829288577d)

Previous change caused EOS to be ignored.

Bug: 27843673
Related-to-bug: 27662364
Change-Id: Ia148a88abc861a9b393f42bc7cd63d8d3ae349bc

Bug: 27662364
Change-Id: I47380545ea7d85845e141e722b0d84f498d27145

Bug: 27662364
Change-Id: I7b26892c41d6f2e690e77478ab855c2fed1ff6b0

Bug: 27569635
Change-Id: I469573f40e21dc9f4c200749d4f220e3a2d31761

Bug: 27533704
Change-Id: I992a7709b92b1cbc3114c97bec48a3fc5b22ba6e

Validate template ID before creating a default request.

Bug: 26866110
Bug: 27568958
Change-Id: Ifda457024f1d5c2b1382f189c1a8d5fda852d30d

and handle dead observers more gracefully

Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518

to prevent a cleared service binder from being used.

Bug: 26040840
Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb

Previous fix accidentally only fixed the fragmented read case.

Bug: 27208621
Change-Id: Ie16f1920b84c8aba613842659238fcd5925694ad

Bug: 26914474
Change-Id: Ie1a86e86d78058d041149fe599a4996e7f8185cf

This can lead to local code execution in media server.
Fix initializes the pointer and checks the error conditions before
returning

Bug: 26403627
Change-Id: I7fa90682060148448dba01d6acbe3471d1ddb500

Camera: Disallow dumping clients directly

Camera service dumps should only be initiated through
ICameraService::dump.

Bug: 26265403
Change-Id: If3ca4718ed74bf33ad8a416192689203029e2803

libvpx has always supported the VPX_ prefixed versions of these defines.
The unprefixed versions have been removed in the most recent release.

https://chromium.googlesource.com/webm/libvpx/+/9cdaa3d72eade9ad162ef8f78a93bd8f85c6de10

BUG=23452792

Change-Id: I8a656f2262f117d7a95271f45100b8c6fd0a470f

Bug: 26365349
Change-Id: Ia363d9f8c231cf255dea852e0bbf5ca466c7990b

Add checks on parameter size field in effect command handlers
to avoid overflow leading to invalid comparison with min allowed
size for command and reply buffers.

Bug: 26347509.
Change-Id: I20e6a9b6de8e5172b957caa1ac9410b9752efa4d
(cherry picked from commit ad1bd92a)

Bug: 25070434
Change-Id: Iade3472c496ac42456e42db35e402f7b66416f5b
(cherry picked from commit b41fd0d4)

DO NOT MERGE - libstagefright: check requested memory size before allocation for SoftMPEG4Encoder and SoftVPXEncoder.

Bug: 25812794
Change-Id: I96dc74734380d462583f6efa33d09946f9532809
(cherry picked from commit 87f8cbb2)
(cherry picked from commit 04629752)

bug: 18730095, 25563255
Change-Id: Ibd4f54907949daae1d095fa0922050310d16698f
(cherry picked from commit fc6cfd83)

Sample decoding still occurs in SoundPoolThread
without holding the SoundPool lock.

Bug: 25781119
Change-Id: I11fde005aa9cf5438e0390a0d2dfe0ec1dd282e8

Bug: 24445127
Change-Id: I1c6cb9e2518b852d48d5d0d625b54409bd4e13ec