OSDN -- 開發和下載開源軟體
繁體中文翻譯狀態 translation status for zh-tw

Android-x86
Fork
捐款

  • R/O
  • HTTP
  • SSH
  • HTTPS
Fork

frameworks-native: 提交

frameworks/native


Commit MetaInfo

修訂4f0301652275eead25c0f9705af3c0b2745bd6fe (tree)
時間2019-10-16 23:52:29
作者Chih-Wei Huang <cwhuang@linu...>
CommiterChih-Wei Huang

Log Message

Android 7.1.2 Release 39 (5787804)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXZfNqgAKCRDorT+BmrEO
eG9xAJ0a+V0GUm1/1ThRnfLwUv4PveqsTACgif5svLv9S1rYYmUh2z09fzmffxE=
=Qwhm
-----END PGP SIGNATURE-----

Merge tag 'android-7.1.2_r39' into nougat-x86

Android 7.1.2 Release 39 (5787804)

Change Summary

差異

--- a/include/binder/Parcel.h
+++ b/include/binder/Parcel.h
@@ -375,6 +375,7 @@ private:
375375 void freeDataNoInit();
376376 void initState();
377377 void scanForFds() const;
378+ status_t validateReadData(size_t len) const;
378379
379380 template<class T>
380381 status_t readAligned(T *pArg) const;
@@ -421,6 +422,7 @@ private:
421422 size_t mObjectsSize;
422423 size_t mObjectsCapacity;
423424 mutable size_t mNextObjectHint;
425+ mutable bool mObjectsSorted;
424426
425427 mutable bool mFdsKnown;
426428 mutable bool mHasFds;
--- a/include/input/InputTransport.h
+++ b/include/input/InputTransport.h
@@ -42,6 +42,13 @@ namespace android {
4242 *
4343 * Note that this structure is used for IPCs so its layout must be identical
4444 * on 64 and 32 bit processes. This is tested in StructLayout_test.cpp.
45+ *
46+ * Since the struct must be aligned to an 8-byte boundary, there could be uninitialized bytes
47+ * in-between the defined fields. This padding data should be explicitly accounted for by adding
48+ * "empty" fields into the struct. This data is memset to zero before sending the struct across
49+ * the socket. Adding the explicit fields ensures that the memset is not optimized away by the
50+ * compiler. When a new field is added to the struct, the corresponding change
51+ * in StructLayout_test should be made.
4552 */
4653 struct InputMessage {
4754 enum {
@@ -62,6 +69,7 @@ struct InputMessage {
6269 union Body {
6370 struct Key {
6471 uint32_t seq;
72+ uint32_t empty1;
6573 nsecs_t eventTime __attribute__((aligned(8)));
6674 int32_t deviceId;
6775 int32_t source;
@@ -80,6 +88,7 @@ struct InputMessage {
8088
8189 struct Motion {
8290 uint32_t seq;
91+ uint32_t empty1;
8392 nsecs_t eventTime __attribute__((aligned(8)));
8493 int32_t deviceId;
8594 int32_t source;
@@ -95,6 +104,7 @@ struct InputMessage {
95104 float xPrecision;
96105 float yPrecision;
97106 uint32_t pointerCount;
107+ uint32_t empty2;
98108 // Note that PointerCoords requires 8 byte alignment.
99109 struct Pointer {
100110 PointerProperties properties;
@@ -125,6 +135,7 @@ struct InputMessage {
125135
126136 bool isValid(size_t actualSize) const;
127137 size_t size() const;
138+ void getSanitizedCopy(InputMessage* msg) const;
128139 };
129140
130141 /*
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -459,6 +459,7 @@ void Parcel::setDataPosition(size_t pos) const
459459
460460 mDataPos = pos;
461461 mNextObjectHint = 0;
462+ mObjectsSorted = false;
462463 }
463464
464465 status_t Parcel::setDataCapacity(size_t size)
@@ -1284,7 +1285,7 @@ status_t Parcel::write(const FlattenableHelperInterface& val)
12841285 if (err) return err;
12851286
12861287 // payload
1287- void* const buf = this->writeInplace(pad_size(len));
1288+ void* const buf = this->writeInplace(len);
12881289 if (buf == NULL)
12891290 return BAD_VALUE;
12901291
@@ -1363,6 +1364,59 @@ void Parcel::remove(size_t /*start*/, size_t /*amt*/)
13631364 LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
13641365 }
13651366
1367+status_t Parcel::validateReadData(size_t upperBound) const
1368+{
1369+ // Don't allow non-object reads on object data
1370+ if (mObjectsSorted || mObjectsSize <= 1) {
1371+data_sorted:
1372+ // Expect to check only against the next object
1373+ if (mNextObjectHint < mObjectsSize && upperBound > mObjects[mNextObjectHint]) {
1374+ // For some reason the current read position is greater than the next object
1375+ // hint. Iterate until we find the right object
1376+ size_t nextObject = mNextObjectHint;
1377+ do {
1378+ if (mDataPos < mObjects[nextObject] + sizeof(flat_binder_object)) {
1379+ // Requested info overlaps with an object
1380+ ALOGE("Attempt to read from protected data in Parcel %p", this);
1381+ return PERMISSION_DENIED;
1382+ }
1383+ nextObject++;
1384+ } while (nextObject < mObjectsSize && upperBound > mObjects[nextObject]);
1385+ mNextObjectHint = nextObject;
1386+ }
1387+ return NO_ERROR;
1388+ }
1389+ // Quickly determine if mObjects is sorted.
1390+ binder_size_t* currObj = mObjects + mObjectsSize - 1;
1391+ binder_size_t* prevObj = currObj;
1392+ while (currObj > mObjects) {
1393+ prevObj--;
1394+ if(*prevObj > *currObj) {
1395+ goto data_unsorted;
1396+ }
1397+ currObj--;
1398+ }
1399+ mObjectsSorted = true;
1400+ goto data_sorted;
1401+
1402+data_unsorted:
1403+ // Insertion Sort mObjects
1404+ // Great for mostly sorted lists. If randomly sorted or reverse ordered mObjects become common,
1405+ // switch to std::sort(mObjects, mObjects + mObjectsSize);
1406+ for (binder_size_t* iter0 = mObjects + 1; iter0 < mObjects + mObjectsSize; iter0++) {
1407+ binder_size_t temp = *iter0;
1408+ binder_size_t* iter1 = iter0 - 1;
1409+ while (iter1 >= mObjects && *iter1 > temp) {
1410+ *(iter1 + 1) = *iter1;
1411+ iter1--;
1412+ }
1413+ *(iter1 + 1) = temp;
1414+ }
1415+ mNextObjectHint = 0;
1416+ mObjectsSorted = true;
1417+ goto data_sorted;
1418+}
1419+
13661420 status_t Parcel::read(void* outData, size_t len) const
13671421 {
13681422 if (len > INT32_MAX) {
@@ -1373,6 +1427,15 @@ status_t Parcel::read(void* outData, size_t len) const
13731427
13741428 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
13751429 && len <= pad_size(len)) {
1430+ if (mObjectsSize > 0) {
1431+ status_t err = validateReadData(mDataPos + pad_size(len));
1432+ if(err != NO_ERROR) {
1433+ // Still increment the data position by the expected length
1434+ mDataPos += pad_size(len);
1435+ ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
1436+ return err;
1437+ }
1438+ }
13761439 memcpy(outData, mData+mDataPos, len);
13771440 mDataPos += pad_size(len);
13781441 ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
@@ -1391,6 +1454,16 @@ const void* Parcel::readInplace(size_t len) const
13911454
13921455 if ((mDataPos+pad_size(len)) >= mDataPos && (mDataPos+pad_size(len)) <= mDataSize
13931456 && len <= pad_size(len)) {
1457+ if (mObjectsSize > 0) {
1458+ status_t err = validateReadData(mDataPos + pad_size(len));
1459+ if(err != NO_ERROR) {
1460+ // Still increment the data position by the expected length
1461+ mDataPos += pad_size(len);
1462+ ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
1463+ return NULL;
1464+ }
1465+ }
1466+
13941467 const void* data = mData+mDataPos;
13951468 mDataPos += pad_size(len);
13961469 ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
@@ -1404,6 +1477,15 @@ status_t Parcel::readAligned(T *pArg) const {
14041477 COMPILE_TIME_ASSERT_FUNCTION_SCOPE(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));
14051478
14061479 if ((mDataPos+sizeof(T)) <= mDataSize) {
1480+ if (mObjectsSize > 0) {
1481+ status_t err = validateReadData(mDataPos + sizeof(T));
1482+ if(err != NO_ERROR) {
1483+ // Still increment the data position by the expected length
1484+ mDataPos += sizeof(T);
1485+ return err;
1486+ }
1487+ }
1488+
14071489 const void* data = mData+mDataPos;
14081490 mDataPos += sizeof(T);
14091491 *pArg = *reinterpret_cast<const T*>(data);
@@ -1825,8 +1907,8 @@ status_t Parcel::readUtf8FromUtf16(std::unique_ptr<std::string>* str) const {
18251907
18261908 const char* Parcel::readCString() const
18271909 {
1828- const size_t avail = mDataSize-mDataPos;
1829- if (avail > 0) {
1910+ if (mDataPos < mDataSize) {
1911+ const size_t avail = mDataSize-mDataPos;
18301912 const char* str = reinterpret_cast<const char*>(mData+mDataPos);
18311913 // is the string's trailing NUL within the parcel's valid bounds?
18321914 const char* eos = reinterpret_cast<const char*>(memchr(str, 0, avail));
@@ -2206,6 +2288,7 @@ void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
22062288 mObjects = const_cast<binder_size_t*>(objects);
22072289 mObjectsSize = mObjectsCapacity = objectsCount;
22082290 mNextObjectHint = 0;
2291+ mObjectsSorted = false;
22092292 mOwner = relFunc;
22102293 mOwnerCookie = relCookie;
22112294 for (size_t i = 0; i < mObjectsSize; i++) {
@@ -2364,6 +2447,7 @@ status_t Parcel::restartWrite(size_t desired)
23642447 mObjects = NULL;
23652448 mObjectsSize = mObjectsCapacity = 0;
23662449 mNextObjectHint = 0;
2450+ mObjectsSorted = false;
23672451 mHasFds = false;
23682452 mFdsKnown = true;
23692453 mAllowFds = true;
@@ -2450,6 +2534,7 @@ status_t Parcel::continueWrite(size_t desired)
24502534 mDataCapacity = desired;
24512535 mObjectsSize = mObjectsCapacity = objectsSize;
24522536 mNextObjectHint = 0;
2537+ mObjectsSorted = false;
24532538
24542539 } else if (mData) {
24552540 if (objectsSize < mObjectsSize) {
@@ -2464,13 +2549,20 @@ status_t Parcel::continueWrite(size_t desired)
24642549 }
24652550 release_object(proc, *flat, this, &mOpenAshmemSize);
24662551 }
2467- binder_size_t* objects =
2468- (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));
2469- if (objects) {
2470- mObjects = objects;
2552+
2553+ if (objectsSize == 0) {
2554+ free(mObjects);
2555+ mObjects = nullptr;
2556+ } else {
2557+ binder_size_t* objects =
2558+ (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));
2559+ if (objects) {
2560+ mObjects = objects;
2561+ }
24712562 }
24722563 mObjectsSize = objectsSize;
24732564 mNextObjectHint = 0;
2565+ mObjectsSorted = false;
24742566 }
24752567
24762568 // We own the data, so we can just do a realloc().
@@ -2543,6 +2635,7 @@ void Parcel::initState()
25432635 mObjectsSize = 0;
25442636 mObjectsCapacity = 0;
25452637 mNextObjectHint = 0;
2638+ mObjectsSorted = false;
25462639 mHasFds = false;
25472640 mFdsKnown = true;
25482641 mAllowFds = true;
--- a/libs/binder/Status.cpp
+++ b/libs/binder/Status.cpp
@@ -66,13 +66,22 @@ status_t Status::readFromParcel(const Parcel& parcel) {
6666 // Skip over fat response headers. Not used (or propagated) in native code.
6767 if (mException == EX_HAS_REPLY_HEADER) {
6868 // Note that the header size includes the 4 byte size field.
69- const int32_t header_start = parcel.dataPosition();
69+ const size_t header_start = parcel.dataPosition();
70+ const size_t header_avail = parcel.dataAvail();
71+
7072 int32_t header_size;
7173 status = parcel.readInt32(&header_size);
7274 if (status != OK) {
7375 setFromStatusT(status);
7476 return status;
7577 }
78+
79+ if (header_size < 0 || static_cast<size_t>(header_size) > header_avail) {
80+ android_errorWriteLog(0x534e4554, "132650049");
81+ setFromStatusT(UNKNOWN_ERROR);
82+ return UNKNOWN_ERROR;
83+ }
84+
7685 parcel.setDataPosition(header_start + header_size);
7786 // And fat response headers are currently only used when there are no
7887 // exceptions, so act like there was no error.
@@ -95,6 +104,7 @@ status_t Status::readFromParcel(const Parcel& parcel) {
95104 if (mException == EX_SERVICE_SPECIFIC) {
96105 status = parcel.readInt32(&mErrorCode);
97106 }
107+
98108 if (status != OK) {
99109 setFromStatusT(status);
100110 return status;
--- a/libs/gui/SensorManager.cpp
+++ b/libs/gui/SensorManager.cpp
@@ -90,7 +90,7 @@ SensorManager& SensorManager::getInstanceForPackage(const String16& packageName)
9090
9191 SensorManager::SensorManager(const String16& opPackageName)
9292 : mSensorList(0), mOpPackageName(opPackageName) {
93- // okay we're not locked here, but it's not needed during construction
93+ Mutex::Autolock _l(mLock);
9494 assertStateLocked();
9595 }
9696
--- a/libs/input/InputTransport.cpp
+++ b/libs/input/InputTransport.cpp
@@ -97,6 +97,102 @@ size_t InputMessage::size() const {
9797 return sizeof(Header);
9898 }
9999
100+/**
101+ * There could be non-zero bytes in-between InputMessage fields. Force-initialize the entire
102+ * memory to zero, then only copy the valid bytes on a per-field basis.
103+ */
104+void InputMessage::getSanitizedCopy(InputMessage* msg) const {
105+ memset(msg, 0, sizeof(*msg));
106+
107+ // Write the header
108+ msg->header.type = header.type;
109+
110+ // Write the body
111+ switch(header.type) {
112+ case InputMessage::TYPE_KEY: {
113+ // uint32_t seq
114+ msg->body.key.seq = body.key.seq;
115+ // nsecs_t eventTime
116+ msg->body.key.eventTime = body.key.eventTime;
117+ // int32_t deviceId
118+ msg->body.key.deviceId = body.key.deviceId;
119+ // int32_t source
120+ msg->body.key.source = body.key.source;
121+ // int32_t action
122+ msg->body.key.action = body.key.action;
123+ // int32_t flags
124+ msg->body.key.flags = body.key.flags;
125+ // int32_t keyCode
126+ msg->body.key.keyCode = body.key.keyCode;
127+ // int32_t scanCode
128+ msg->body.key.scanCode = body.key.scanCode;
129+ // int32_t metaState
130+ msg->body.key.metaState = body.key.metaState;
131+ // int32_t repeatCount
132+ msg->body.key.repeatCount = body.key.repeatCount;
133+ // nsecs_t downTime
134+ msg->body.key.downTime = body.key.downTime;
135+ break;
136+ }
137+ case InputMessage::TYPE_MOTION: {
138+ // uint32_t seq
139+ msg->body.motion.seq = body.motion.seq;
140+ // nsecs_t eventTime
141+ msg->body.motion.eventTime = body.motion.eventTime;
142+ // int32_t deviceId
143+ msg->body.motion.deviceId = body.motion.deviceId;
144+ // int32_t source
145+ msg->body.motion.source = body.motion.source;
146+ // int32_t action
147+ msg->body.motion.action = body.motion.action;
148+ // int32_t actionButton
149+ msg->body.motion.actionButton = body.motion.actionButton;
150+ // int32_t flags
151+ msg->body.motion.flags = body.motion.flags;
152+ // int32_t metaState
153+ msg->body.motion.metaState = body.motion.metaState;
154+ // int32_t buttonState
155+ msg->body.motion.buttonState = body.motion.buttonState;
156+ // int32_t edgeFlags
157+ msg->body.motion.edgeFlags = body.motion.edgeFlags;
158+ // nsecs_t downTime
159+ msg->body.motion.downTime = body.motion.downTime;
160+ // float xOffset
161+ msg->body.motion.xOffset = body.motion.xOffset;
162+ // float yOffset
163+ msg->body.motion.yOffset = body.motion.yOffset;
164+ // float xPrecision
165+ msg->body.motion.xPrecision = body.motion.xPrecision;
166+ // float yPrecision
167+ msg->body.motion.yPrecision = body.motion.yPrecision;
168+ // uint32_t pointerCount
169+ msg->body.motion.pointerCount = body.motion.pointerCount;
170+ //struct Pointer pointers[MAX_POINTERS]
171+ for (size_t i = 0; i < body.motion.pointerCount; i++) {
172+ // PointerProperties properties
173+ msg->body.motion.pointers[i].properties.id = body.motion.pointers[i].properties.id;
174+ msg->body.motion.pointers[i].properties.toolType =
175+ body.motion.pointers[i].properties.toolType,
176+ // PointerCoords coords
177+ msg->body.motion.pointers[i].coords.bits = body.motion.pointers[i].coords.bits;
178+ const uint32_t count = BitSet64::count(body.motion.pointers[i].coords.bits);
179+ memcpy(&msg->body.motion.pointers[i].coords.values[0],
180+ &body.motion.pointers[i].coords.values[0],
181+ count * (sizeof(body.motion.pointers[i].coords.values[0])));
182+ }
183+ break;
184+ }
185+ case InputMessage::TYPE_FINISHED: {
186+ msg->body.finished.seq = body.finished.seq;
187+ msg->body.finished.handled = body.finished.handled;
188+ break;
189+ }
190+ default: {
191+ LOG_FATAL("Unexpected message type %i", header.type);
192+ break;
193+ }
194+ }
195+}
100196
101197 // --- InputChannel ---
102198
@@ -150,10 +246,12 @@ status_t InputChannel::openInputChannelPair(const String8& name,
150246 }
151247
152248 status_t InputChannel::sendMessage(const InputMessage* msg) {
153- size_t msgLength = msg->size();
249+ const size_t msgLength = msg->size();
250+ InputMessage cleanMsg;
251+ msg->getSanitizedCopy(&cleanMsg);
154252 ssize_t nWrite;
155253 do {
156- nWrite = ::send(mFd, msg, msgLength, MSG_DONTWAIT | MSG_NOSIGNAL);
254+ nWrite = ::send(mFd, &cleanMsg, msgLength, MSG_DONTWAIT | MSG_NOSIGNAL);
157255 } while (nWrite == -1 && errno == EINTR);
158256
159257 if (nWrite < 0) {
--- a/libs/input/tests/StructLayout_test.cpp
+++ b/libs/input/tests/StructLayout_test.cpp
@@ -63,6 +63,9 @@ void TestInputMessageAlignment() {
6363 CHECK_OFFSET(InputMessage::Body::Motion, yPrecision, 68);
6464 CHECK_OFFSET(InputMessage::Body::Motion, pointerCount, 72);
6565 CHECK_OFFSET(InputMessage::Body::Motion, pointers, 80);
66+
67+ CHECK_OFFSET(InputMessage::Body::Finished, seq, 0);
68+ CHECK_OFFSET(InputMessage::Body::Finished, handled, 4);
6669 }
6770
6871 } // namespace android
Show on old repository browser