stagefrightrecorder_mms stagefright_stagefright漏洞修复(4)

…

262        case CREATE_MEDIA_RECORDER: {
263            CHECK_INTERFACE(IMediaPlayerService, data, reply);
264            sp<IMediaRecorder> recorder = createMediaRecorder();
265            reply->writeStrongBinder(recorder->asBinder());
266            return NO_ERROR;
267        } break;

…

337        default:
338            return BBinder::onTransact(code, data, reply, flags);
339    }
340}

(/frameworks/av/media/libmediaplayerservice/MediaPlayerService.cpp)

231sp<IMediaRecorder> MediaPlayerService::createMediaRecorder()232{233 pid_t pid = IPCThreadState::self()->getCallingPid();234 sp<MediaRecorderClient> recorder = new MediaRecorderClient(this, pid);235 wp<MediaRecorderClient> w = recorder;236 Mutex::Autolock lock(mLock);237 mMediaRecorderClients.add(w);238 ALOGV("Create new media recorder client from pid %d", pid);239 return recorder;240}

(6)如此MediaRecorder.cpp就得到了一个recorder的实例，对它来说这个实例和本地的其他类的实例没什么用法上的区别，但其实这个实例是运行在另外一个进程中。实现这种假象的就是binder机制。在MediaRecorderClient的构造函数中，才会真正的创建StagefrightRecorder的具体实例，即真正的录制对象，使用的StageFright多媒体框架。在android 4.0以后只有StagefrightRecorder一个录制框架。在2.2、2.3中还存在另外一个录制对象PVMediaRecorder，使用的是OpenCore框架实现录音或录像。

(/frameworks/av/media/libmediaplayerservice/MediaRecorderClient.cpp)

303MediaRecorderClient::MediaRecorderClient(const sp<MediaPlayerService>& service, pid_t pid)
304{
305    ALOGV("Client constructor");
306    mPid = pid;
307    mRecorder = new StagefrightRecorder;
308    mMediaPlayerService = service;
309}

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/tongxinshuyu/article-50205-4.html