stagefrightrecorder_mms stagefright_stagefright漏洞修复(3)

(3)继而调用mediarecorder.cpp的构造函数，它首先会从ServiceManager中获得MediaPlayerService服务，然后通过服务来创建recorder。这个recorder就是录音的真实实例。

(frameworks\av\media\libmedia\mediarecorder.cpp)

617MediaRecorder::MediaRecorder() : mSuceMediaSource(NULL)
618{
619    ALOGV("constructor");
620
621    const sp<IMediaPlayerService>& service(getMediaPlayerService());
622    if (service != NULL) {
623        mMediaRecorder = service->createMediaRecorder();
624    }
625    if (mMediaRecorder != NULL) {
626        mCurrentState = MEDIA_RECORDER_IDLE;
627    }
628
629
630    doCleanUp();
631}

(4)通过getMediaPlayerService得到的service其实是BpMediaPlayerService，它和mediaserver进程中的BnMediaPlayerService是相对应的，共同负责进程间binder通信。BpMediaPlayerService中的createMediaRecorder其实是通过binder机制将CREATE_MEDIA_RECORDER消息发送出去。

(/frameworks/av/media/libmedia/IMediaPlayerService.cpp)

81    virtual sp<IMediaRecorder> createMediaRecorder()
82    {
83        Parcel data, reply;
84        data.writeInteceToken(IMediaPlayerService::getInteceDescriptor());
85        remote()->transact(CREATE_MEDIA_RECORDER, data, &reply);
86        return intece_cast<IMediaRecorder>(reply.readStrongBinder());
87    }

(5)在BnMediaPlayerService中，通过onTransact()来处理接收到的消息，并返回结果。当接收消息中的code为CREATE_MEDIA_RECORDER时，调用MediaPlayerService 中的createMediaRecorder函数。在该函数中创建了一个MediaRecorderClient的实例，也就是说MediaPlayerService会为每个client应用进程创建一个相应的MediaRecorderClient的实例，来提供服务。

(/frameworks/av/media/libmedia/IMediaPlayerService.cpp)

210status_t BnMediaPlayerService::onTransact(
211    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
212{
213    switch (code) {
214        case CREATE: {
215            CHECK_INTERFACE(IMediaPlayerService, data, reply);
216            sp<IMediaPlayerClient> client =
217                intece_cast<IMediaPlayerClient>(data.readStrongBinder());
218            int audioSessionId = data.readInt32();
219            sp<IMediaPlayer> player = create(client, audioSessionId);
220            reply->writeStrongBinder(player->asBinder());
221            return NO_ERROR;
222        } break;

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/tongxinshuyu/article-50205-3.html