media: miscellaneous fixes to VT contribution

- fix MediaSource.h path
- fix setDataSource binder code
- use MediaCodecConstants instead of OMX/ACodec constants
- fix spacing
- fix typos
- remove unused code
- commented some tricky code segments
- AAVC/HEVCAssembler: re-read next buffer if buffer was deleted
- RTPSource: pull out constants kMinVideoBitrate and kBufferingPollIntervalUs
- RTPSource: check state early in prepareAsync
- RTPSource: fix potential null dereference in setSource
- ARTPAssembler: make showing queue runtime configurable via debug.stagefright.rtp bool property
- ARTPWriter: fix security issues: protect against reading OOB in
  sendSPSPPSIfIFrame and StripStartcode
- ARTPWriter: free buffers early in destructor
- ARTPWriter: create PPS buffer only if there is PPS
- ARTPConnection: fix security issues: protect against reading OOB in
  parseRTPExt, parseTSFB, and parsePSFB. Also remove remote null-dereference.
- AHEVCAssembler: fix security issues: protect against reading OOB in
  addFragmentedNALUnit

Bug: 121230209
Test: build
Merged-in: Iada8b878e396452c1d281c60f3754e13e34bcddb
Change-Id: Iada8b878e396452c1d281c60f3754e13e34bcddb
diff --git a/media/libmediaplayerservice/StagefrightRecorder.cpp b/media/libmediaplayerservice/StagefrightRecorder.cpp
index 1238f6b..f6a3728 100644
--- a/media/libmediaplayerservice/StagefrightRecorder.cpp
+++ b/media/libmediaplayerservice/StagefrightRecorder.cpp
@@ -44,6 +44,7 @@
 #include <media/stagefright/CameraSourceTimeLapse.h>
 #include <media/stagefright/MPEG2TSWriter.h>
 #include <media/stagefright/MPEG4Writer.h>
+#include <media/stagefright/MediaCodecConstants.h>
 #include <media/stagefright/MediaDefs.h>
 #include <media/stagefright/MetaData.h>
 #include <media/stagefright/MediaCodecSource.h>
@@ -577,10 +578,10 @@
     mVideoBitRate = bitRate;
 
     // A new bitrate(TMMBR) should be applied on runtime as well if OutputFormat is RTP_AVP
-    if (mOutputFormat == OUTPUT_FORMAT_RTP_AVP &&  mStarted && mPauseStartTimeUs == 0) {
-        /* Regular I frames overloads on the network so we should consider about it.
-         * Discounted encoding bitrate will be margins for the overloads.
-         * But applied bitrate reply(TMMBN) must be sent as same as TMMBR */
+    if (mOutputFormat == OUTPUT_FORMAT_RTP_AVP && mStarted && mPauseStartTimeUs == 0) {
+        // Regular I frames may overload the network so we reduce the bitrate to allow
+        // margins for the I frame overruns.
+        // Still send requested bitrate (TMMBR) in the reply (TMMBN).
         const float coefficient = 0.8f;
         mVideoBitRate = (bitRate * coefficient) / 1000 * 1000;
         mVideoEncoderSource->setEncodingBitrate(mVideoBitRate);
@@ -593,6 +594,7 @@
 
 status_t StagefrightRecorder::setParamVideoBitRateMode(int32_t bitRateMode) {
     ALOGV("setParamVideoBitRateMode: %d", bitRateMode);
+    // TODO: clarify what bitrate mode of -1 is as these start from 0
     if (bitRateMode < -1) {
         ALOGE("Unsupported video bitrate mode: %d", bitRateMode);
         return BAD_VALUE;
@@ -1990,7 +1992,6 @@
     }
 
     format->setInt32("bitrate", mVideoBitRate);
-    // OMX encoder option how to control bitrate
     format->setInt32("bitrate-mode", mVideoBitRateMode);
     format->setInt32("frame-rate", mFrameRate);
     format->setInt32("i-frame-interval", mIFramesIntervalSec);
@@ -2414,8 +2415,8 @@
     mVideoHeight   = 144;
     mFrameRate     = -1;
     mVideoBitRate  = 192000;
-    // Following ACodec's default
-    mVideoBitRateMode = OMX_Video_ControlRateVariable;
+    // Following MediaCodec's default
+    mVideoBitRateMode = BITRATE_MODE_VBR;
     mSampleRate    = 8000;
     mAudioChannels = 1;
     mAudioBitRate  = 12200;
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
index a16b6be..4e7daa5 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayer.cpp
@@ -1928,8 +1928,6 @@
 
     format->setInt32("priority", 0 /* realtime */);
 
-    AString mime;
-    format->findString("mime", &mime);
     if (mDataSourceType == DATA_SOURCE_TYPE_RTP) {
         ALOGV("instantiateDecoder: set decoder error free on stream corrupt.");
         format->setInt32("corrupt-free", true);
diff --git a/media/libmediaplayerservice/nuplayer/RTPSource.cpp b/media/libmediaplayerservice/nuplayer/RTPSource.cpp
index 7e77456..a6601cd 100644
--- a/media/libmediaplayerservice/nuplayer/RTPSource.cpp
+++ b/media/libmediaplayerservice/nuplayer/RTPSource.cpp
@@ -80,6 +80,9 @@
         mLooper->registerHandler(mRTPConn);
     }
 
+    CHECK_EQ(mState, (int)DISCONNECTED);
+    mState = CONNECTING;
+
     setParameters(mRTPParams);
 
     TrackInfo *info = NULL;
@@ -111,7 +114,7 @@
         // index(i) should be started from 1. 0 is reserved for [root]
         mRTPConn->addStream(sockRtp, sockRtcp, desc, i + 1, notify, false);
         mRTPConn->setSelfID(info->mSelfID);
-        mRTPConn->setMinMaxBitrate(videoMinBitrate, info->mAS * 1000);
+        mRTPConn->setMinMaxBitrate(kMinVideoBitrate, info->mAS * 1000 /* kbps */);
 
         info->mRTPSocket = sockRtp;
         info->mRTCPSocket = sockRtcp;
@@ -139,9 +142,6 @@
         info->mSource = source;
     }
 
-    CHECK_EQ(mState, (int)DISCONNECTED);
-    mState = CONNECTING;
-
     if (mInPreparationPhase) {
         mInPreparationPhase = false;
         notifyPrepared();
@@ -340,7 +340,7 @@
 
 void NuPlayer::RTPSource::schedulePollBuffering() {
     sp<AMessage> msg = new AMessage(kWhatPollBuffering, this);
-    msg->post(1000000ll); // 1 second intervals
+    msg->post(kBufferingPollIntervalUs); // 1 second intervals
 }
 
 void NuPlayer::RTPSource::onPollBuffering() {
@@ -412,6 +412,8 @@
                 break;
             }
 
+            // Implicitly assert on valid trackIndex here, which we ensure by
+            // never removing tracks.
             TrackInfo *info = &mTracks.editItemAt(trackIndex);
 
             sp<AnotherPacketSource> source = info->mSource;
@@ -492,6 +494,8 @@
     ALOGV("onTimeUpdate track %d, rtpTime = 0x%08x, ntpTime = %#016llx",
          trackIndex, rtpTime, (long long)ntpTime);
 
+    // convert ntpTime in Q32 seconds to microseconds. Note: this will not lose precision
+    // because ntpTimeUs is at most 52 bits (double holds 53 bits)
     int64_t ntpTimeUs = (int64_t)(ntpTime * 1E6 / (1ll << 32));
 
     TrackInfo *track = &mTracks.editItemAt(trackIndex);
@@ -659,10 +663,10 @@
 
         const char *mime = value.string();
         const char *delimiter = strchr(mime, '/');
-        info->mCodecName = (delimiter + 1);
+        info->mCodecName = delimiter ? (delimiter + 1) : "<none>";
 
         ALOGV("rtp-param-mime-type: mMimeType (%s) => mCodecName (%s)",
-            info->mMimeType.string(), info->mCodecName.string());
+                info->mMimeType.string(), info->mCodecName.string());
     } else if (key == "video-param-decoder-profile") {
         info->mCodecProfile = atoi(value);
     } else if (key == "video-param-decoder-level") {
diff --git a/media/libmediaplayerservice/nuplayer/RTPSource.h b/media/libmediaplayerservice/nuplayer/RTPSource.h
index 7666087..5085a7e 100644
--- a/media/libmediaplayerservice/nuplayer/RTPSource.h
+++ b/media/libmediaplayerservice/nuplayer/RTPSource.h
@@ -46,8 +46,6 @@
 struct ALooper;
 struct AnotherPacketSource;
 
-const int32_t videoMinBitrate = 192000;
-
 struct NuPlayer::RTPSource : public NuPlayer::Source {
     RTPSource(
             const sp<AMessage> &notify,
@@ -96,6 +94,9 @@
         kWhatSetBufferingSettings = 'sBuS',
     };
 
+    const int64_t kBufferingPollIntervalUs = 1000000ll;
+    const int32_t kMinVideoBitrate = 192000; /* bps */
+
     enum State {
         DISCONNECTED,
         CONNECTING,