The uninitialized local variables pick up
whatever the memory content was there on stack.
This data gets sent to the remote process in
case of a failed transaction, which is a security
issue. Fixed.
(Partial manual merge of master change
12ba0f57d028a9c8f4eb3afddc326b70677d1e0c. Rest
to automerge from klp-dev)
For b/23696300
Change-Id: I704c9fab327b3545c58e8a9a96ac542eb7469c2a
If the custom sensor requires the BODY SENSOR permission, we should add
the body sensors app op for the custom sensor
Bug: 23396558
Change-Id: I132917d1bca12c76c8a9fb146e00951cba3e6d7a
If SensorService hasn't started when SensorManager instance is requested, keep retrying for a
longer duration.
Bug: 22529981
Change-Id: I4ba6b760608e34d79273aeb39568f0fa72fbaf9d
writeByteArray writes the size using sizeof(size_t), however it is always
read using readInt32(). On devices where sizeof(size_t) != 4 this causes
extra bytes to be written.
BUG: 22204736
Change-Id: I8d4507b6b616857ef5827f1fe9da0907d09abf0e
Incoming surface damage was not aware that the EGL implementation was
rotating buffers in response to SurfaceFlinger's transform hint. This
didn't affect all cases because the effect was to apply a 90 degree
rotation instead of a 270 degree rotation. For full-screen updates,
things more or less worked, but in other cases this caused corruption.
This fixes that by correctly undoing the effect of rotated buffers on
the incoming surface damage, and then passing that damage down
untouched to HWC.
Bug: 22068334
Change-Id: I226ecfc7a91fe2e16edd2aa6d9149f0d26b529d6
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
(cherry picked from commit 27182be9f2)
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
(cherry picked from commit 27182be9f2)
This allows changes to the SECURE flag to propagate down to
Layers in SurfaceFlinger so that WindowManager can change it on the fly
in response to device policy updates.
Bug: 20934462
Change-Id: I558f6d22c6273be373f1f480365e42536af18a33
When we have excess pixels that need to be removed from (for example)
the left and right sides, we currently do something like:
left += excess / 2;
right -= excess / 2;
If excess is odd, however, this removes 1 too few pixels since the odd
pixel gets rounded down twice. This changes the math to effectively:
left += excess / 2;
right -= (excess - excess / 2);
Which removes the correct total number of pixels.
Bug: 19611086
Change-Id: I8d1ad9fe7ba67c149794c148663d12acbccccef0
Make sure that we don't go haywire if an exponential buffer growth
operation winds up wrapping integer range. Along the way, fix a
bookkeeping bug in BufferedTextOutput that would cause it to keep
spuriously realloc()ing on every append().
Bug 20674694
Change-Id: Ia845b7de36b90672a151a918ffc26c7da68e20a2
We now check for fd-legality before committing binder objects to
the flattened data buffer rather than after. Previously we would
wind up corrupting the parcel and incurring driver-level errors,
as well as potentially leaking FDs.
Bug 21428802
Change-Id: Ice0d641b3dcc41fb1b8c68ce2e2ebd744c2863a1
Adds a getConsumerName method to IGraphicBufferProducer and Surface.
Currently, the name is cached inside of IGBP and is update on connect
and dequeueBuffer, which should be good enough for most uses.
Bug: 6667401
Change-Id: I22c7881d778e495cf8276de7bbcd769e52429915
Add functions to allow a client to take over the ashmem region
that was transferred so that it can claim it for its own and
reuse it.
Add support for mutable ashmem regions too.
Bug: 21428802
Change-Id: I16eca338cdb99b07d81fc43573d53ce86dbc60c8
Adds a getConsumerName method to IGraphicBufferProducer and Surface.
Currently, the name is cached inside of IGBP and is updated on connect
and dequeueBuffer, which should be good enough for most uses.
Bug: 6667401
Change-Id: Ife94bd89023fe7c00bad916932b9a19233fd2290
Attempts to replicate Java parceling in native code is fraught with
peril.
Change-Id: I4359036c5dddd1b886d886beef1d060523e53e5f
(cherry picked from commit f47a381001)
This change allows producers to set a generation number on a
BufferQueue. This number will be embedded in any new GraphicBuffers
created in that BufferQueue, and attempts to attach buffers which have
a different generation number will fail.
It also plumbs the setGenerationNumber method through Surface, with the
additional effect that any buffers attached to the Surface after
setting a new generation number will automatically be updated with the
new number (as opposed to failing, as would happen on through IGBP).
Bug: 20923096
Change-Id: I32bf726b035f99c3e5834beaf76afb9f01adcbc2
Clears the sp<GraphicBuffer> returned by createGraphicBuffer when there
is an error during unflattening.
Bug: 21498231
Change-Id: I886da4474fc06853cc59188d62044b7d7549126b
On devices that have the crop image extension the crop is not applied to the
transform matrix so we have to expect different results in this case.
Change-Id: If62dec1111fb77c9fa2c4332d121665960ce0216
Applies GRALLOC_USAGE_ALLOC_MASK to the incoming usage bits before
calling alloc on the gralloc module. This filters out the new flag
GRALLOC_USAGE_FOREIGN_BUFFERS, which is used to send a hint to the
producer, but which does not affect the allocation of buffers.
Bug: 19801661
Change-Id: Ia37a3eddba2e97598e50ac3e10877430adfa9247
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
Flips the width and height when the buffer comes in with a 90 degree
rotation so that performing the Y-flip from GL works correctly.
Bug: 20761426
Change-Id: I41c9edc8549c6cbdb534277b996ff20c59034582
