Merge cherrypicks of [2890126, 2889507, 2890138, 2890127, 2890128, 2891029, 2891030, 2891031, 2891032, 2891033, 2891034, 2891036, 2891037, 2891038, 2891039, 2891040, 2890763, 2890764, 2890765, 2890766, 2890767, 2890768, 2891129, 2891130, 2891131, 2890139, 2890140, 2890141, 2890142, 2890143, 2890144, 2890145, 2890536, 2891066, 2890146, 2891133, 2891134, 2891135, 2891452, 2891453, 2891454, 2891455, 2891456, 2891457, 2891458, 2890150, 2890151, 2891459, 2891460, 2891461, 2891462, 2891633, 2891638, 2891639, 2891790, 2891808, 2891849, 2891850, 2891759, 2891760, 2891929, 2891930, 2891643, 2891743, 2891716] into nyc-bugfix-release
Change-Id: If42c8561f326af845c33cf44ddbacec2ff851ffb
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index 09e7cb6..56cdf26 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -913,7 +913,11 @@
// Call back without the main BufferQueue lock held, but with the callback
// lock held so we can ensure that callbacks occur in order
- {
+
+ int connectedApi;
+ sp<Fence> lastQueuedFence;
+
+ { // scope for the lock
Mutex::Autolock lock(mCallbackMutex);
while (callbackTicket != mCurrentCallbackTicket) {
mCallbackCondition.wait(mCallbackMutex);
@@ -925,20 +929,24 @@
frameReplacedListener->onFrameReplaced(item);
}
+ connectedApi = mCore->mConnectedApi;
+ lastQueuedFence = std::move(mLastQueueBufferFence);
+
+ mLastQueueBufferFence = std::move(fence);
+ mLastQueuedCrop = item.mCrop;
+ mLastQueuedTransform = item.mTransform;
+
++mCurrentCallbackTicket;
mCallbackCondition.broadcast();
}
// Wait without lock held
- if (mCore->mConnectedApi == NATIVE_WINDOW_API_EGL) {
+ if (connectedApi == NATIVE_WINDOW_API_EGL) {
// Waiting here allows for two full buffers to be queued but not a
// third. In the event that frames take varying time, this makes a
// small trade-off in favor of latency rather than throughput.
- mLastQueueBufferFence->waitForever("Throttling EGL Production");
+ lastQueuedFence->waitForever("Throttling EGL Production");
}
- mLastQueueBufferFence = fence;
- mLastQueuedCrop = item.mCrop;
- mLastQueuedTransform = item.mTransform;
return NO_ERROR;
}
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 7d7d09d..5b7068a 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -26,6 +26,7 @@
#include <binder/Parcel.h>
#include <binder/IInterface.h>
+#include <gui/BufferQueueDefs.h>
#include <gui/IGraphicBufferProducer.h>
#include <gui/IProducerListener.h>
@@ -190,8 +191,16 @@
if (result != NO_ERROR) {
return result;
}
+
*slot = reply.readInt32();
result = reply.readInt32();
+ if (result == NO_ERROR &&
+ (*slot < 0 || *slot >= BufferQueueDefs::NUM_BUFFER_SLOTS)) {
+ ALOGE("attachBuffer returned invalid slot %d", *slot);
+ android_errorWriteLog(0x534e4554, "37478824");
+ return UNKNOWN_ERROR;
+ }
+
return result;
}
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index bcfe714..f1fcca8 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -269,6 +269,12 @@
return result;
}
+ if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+ ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+ android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+ return FAILED_TRANSACTION;
+ }
+
Mutex::Autolock lock(mMutex);
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);
diff --git a/libs/ui/Fence.cpp b/libs/ui/Fence.cpp
index bf24ffb..1b2f34d 100644
--- a/libs/ui/Fence.cpp
+++ b/libs/ui/Fence.cpp
@@ -157,7 +157,7 @@
return INVALID_OPERATION;
}
- if (size < 1) {
+ if (size < getFlattenedSize()) {
return NO_MEMORY;
}
