Merge "Camera: Allocate correctly-sized buffers for DEPTH_POINT_CLOUD" into mnc-dev
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
index 214315f..77b9799 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
@@ -632,10 +632,13 @@
ALOGD("onSetVideoSurface(%p, %s video decoder)",
surface.get(),
- (mSource != NULL && mSource->getFormat(false /* audio */) != NULL
+ (mSource != NULL && mStarted && mSource->getFormat(false /* audio */) != NULL
&& mVideoDecoder != NULL) ? "have" : "no");
- if (mSource == NULL || mSource->getFormat(false /* audio */) == NULL
+ // Need to check mStarted before calling mSource->getFormat because NuPlayer might
+ // be in preparing state and it could take long time.
+ // When mStarted is true, mSource must have been set.
+ if (mSource == NULL || !mStarted || mSource->getFormat(false /* audio */) == NULL
// NOTE: mVideoDecoder's mSurface is always non-null
|| (mVideoDecoder != NULL && mVideoDecoder->setVideoSurface(surface) == OK)) {
performSetSurface(surface);
diff --git a/media/libstagefright/DRMExtractor.cpp b/media/libstagefright/DRMExtractor.cpp
index 63cb430..9cb6e86 100644
--- a/media/libstagefright/DRMExtractor.cpp
+++ b/media/libstagefright/DRMExtractor.cpp
@@ -186,7 +186,8 @@
srcOffset += mNALLengthSize;
- if (srcOffset + nalLength > len) {
+ size_t end = srcOffset + nalLength;
+ if (end > len || end < srcOffset) {
if (decryptedDrmBuffer.data) {
delete [] decryptedDrmBuffer.data;
decryptedDrmBuffer.data = NULL;
diff --git a/media/libstagefright/id3/ID3.cpp b/media/libstagefright/id3/ID3.cpp
index 38ba844..a90d958 100644
--- a/media/libstagefright/id3/ID3.cpp
+++ b/media/libstagefright/id3/ID3.cpp
@@ -327,7 +327,7 @@
size_t oldSize = mSize;
size_t offset = 0;
- while (offset + 10 <= mSize) {
+ while (mSize >= 10 && offset <= mSize - 10) {
if (!memcmp(&mData[offset], "\0\0\0\0", 4)) {
break;
}
@@ -339,7 +339,7 @@
return false;
}
- if (offset + dataSize + 10 > mSize) {
+ if (dataSize > mSize - 10 - offset) {
return false;
}
@@ -349,6 +349,9 @@
if (flags & 1) {
// Strip data length indicator
+ if (mSize < 14 || mSize - 14 < offset) {
+ return false;
+ }
memmove(&mData[offset + 10], &mData[offset + 14], mSize - offset - 14);
mSize -= 4;
dataSize -= 4;
diff --git a/services/audiopolicy/AudioPolicyInterface.h b/services/audiopolicy/AudioPolicyInterface.h
index 8523fc5..c1e7bc0 100644
--- a/services/audiopolicy/AudioPolicyInterface.h
+++ b/services/audiopolicy/AudioPolicyInterface.h
@@ -64,6 +64,7 @@
API_INPUT_MIX_EXT_POLICY_REROUTE,// used for platform audio rerouting, where mixes are
// handled by external and dynamically installed
// policies which reroute audio mixes
+ API_INPUT_TELEPHONY_RX, // used for capture from telephony RX path
} input_type_t;
public:
diff --git a/services/audiopolicy/managerdefault/AudioPolicyManager.cpp b/services/audiopolicy/managerdefault/AudioPolicyManager.cpp
index fc27789..e7f6864 100644
--- a/services/audiopolicy/managerdefault/AudioPolicyManager.cpp
+++ b/services/audiopolicy/managerdefault/AudioPolicyManager.cpp
@@ -1351,6 +1351,8 @@
} else if (audio_is_remote_submix_device(device)) {
address = String8("0");
*inputType = API_INPUT_MIX_CAPTURE;
+ } else if (device == AUDIO_DEVICE_IN_TELEPHONY_RX) {
+ *inputType = API_INPUT_TELEPHONY_RX;
} else {
*inputType = API_INPUT_LEGACY;
}
diff --git a/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp b/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
index 65639c3..793c26a 100644
--- a/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
+++ b/services/audiopolicy/service/AudioPolicyInterfaceImpl.cpp
@@ -303,6 +303,8 @@
switch (inputType) {
case AudioPolicyInterface::API_INPUT_LEGACY:
break;
+ case AudioPolicyInterface::API_INPUT_TELEPHONY_RX:
+ // FIXME: use the same permission as for remote submix for now.
case AudioPolicyInterface::API_INPUT_MIX_CAPTURE:
if (!captureAudioOutputAllowed()) {
ALOGE("getInputForAttr() permission denied: capture not allowed");