stagefrightrecorder_mms stagefright_stagefright漏洞修复(2)

204<span style="white-space:pre">	</span>void MediaPlayerService::instantiate() {
205    <span style="white-space:pre">		</span>defaultServiceManager()->addService(
206            <span style="white-space:pre">		</span>String16("media.player"), new MediaPlayerService());
207<span style="white-space:pre">	</span>}

(2)应用层创建MediaRecorder实例：mMediaRecorder = new MediaRecorder(); 调用SDK中MediaRecorder.java

(frameworks\base\media\java\android\media\MediaRecorder.java)

98    public MediaRecorder() {
99
100        Looper looper;
101        if ((looper = Looper.myLooper()) != null) {
102            mEventHandler = new EventHandler(this, looper);
103        } else if ((looper = Looper.getMainLooper()) != null) {
104            mEventHandler = new EventHandler(this, looper);
105        } else {
106            mEventHandler = null;
107        }
108
109        String packageName = ActivityThread.currentPackageName();
110        /* Native setup requires a weak reference to our object.
111         * Its easier to create it here than in C++.
112         */
113        native_setup(new WeakReference<MediaRecorder>(this), packageName);
114    }

通过JNI方式调用到framework层android_media_MediaRecorder.cpp。

(\frameworks\base\media\jni\android_media_MediaRecorder.cpp)

418static void
419android_media_MediaRecorder_native_setup(JNIEnv *env, jobject thiz, jobject weak_this,
420                                         jstring packageName)
421{
422    ALOGV("setup");
423
424    sp<MediaRecorder> mr = new MediaRecorder();
425    if (mr == NULL) {
426        jniThrowException(env, "java/lang/RuntimeException", "Out of memory");
427        return;
428    }
429    if (mr->initCheck() != NO_ERROR) {
430        jniThrowException(env, "java/lang/RuntimeException", "Unable to initialize media recorder");
431        return;
432    }
433
434    // create new listener and give it to MediaRecorder
435    sp<JNIMediaRecorderListener> listener = new JNIMediaRecorderListener(env, thiz, weak_this);
436    mr->setListener(listener);
437
438   // Convert client name jstring to String16
439    const char16_t *rawClientName = env->GetStringChars(packageName, NULL);
440    jsize rawClientNameLen = env->GetStringLength(packageName);
441    String16 clientName(rawClientName, rawClientNameLen);
442    env->ReleaseStringChars(packageName, rawClientName);
443
444    // pass client package name for permissions tracking
445    mr->setClientName(clientName);
446
447    setMediaRecorder(env, thiz, mr);
448}

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/tongxinshuyu/article-50205-2.html