fix the out-of-bounds access
[platform/core/uifw/libtbm.git] / src / tbm_bufmgr.c
index 64b12f6..c2c1d53 100644 (file)
@@ -56,7 +56,7 @@ int b_dump_queue;
 static pthread_mutex_t gLock = PTHREAD_MUTEX_INITIALIZER;
 static pthread_mutex_t tbm_bufmgr_lock = PTHREAD_MUTEX_INITIALIZER;
 static __thread tbm_error_e tbm_last_error = TBM_ERROR_NONE;
-
+static double scale_factor = 0;
 static void _tbm_bufmgr_mutex_unlock(void);
 
 //#define TBM_BUFMGR_INIT_TIME
@@ -77,6 +77,8 @@ static void _tbm_bufmgr_mutex_unlock(void);
 #define GET_MODULE_MINOR_VERSION(vers)    (((vers) >> 16) & 0xFF)
 #define GET_MODULE_PATCHLEVEL(vers)    ((vers) & 0xFFFF)
 
+#define MAX_SIZE_N(dest)       (sizeof(dest) - strlen(dest) - 1)
+
 /* check condition */
 #define TBM_BUFMGR_RETURN_IF_FAIL(cond) {\
        if (!(cond)) {\
@@ -153,18 +155,22 @@ _tbm_flag_to_str(int f)
                int c = 0;
 
                if (f & TBM_BO_SCANOUT)
-                       c = snprintf(&str[c], 255, "SCANOUT");
+                       c += snprintf(&str[c], 255-c, "SCANOUT");
 
                if (f & TBM_BO_NONCACHABLE) {
-                       if (c)
-                               c = snprintf(&str[c], 255, ", ");
-                       c = snprintf(&str[c], 255, "NONCACHABLE,");
+                       if (c >= 0 && c < 255)
+                               c += snprintf(&str[c], 255-c, ", ");
+
+                       if (c >= 0 && c < 255)
+                               c += snprintf(&str[c], 255-c, "NONCACHABLE,");
                }
 
                if (f & TBM_BO_WC) {
-                       if (c)
-                               c = snprintf(&str[c], 255, ", ");
-                       c = snprintf(&str[c], 255, "WC");
+                       if (c >= 0 && c < 255)
+                               c += snprintf(&str[c], 255-c, ", ");
+
+                       if (c >= 0 && c < 255)
+                               c += snprintf(&str[c], 255-c, "WC");
                }
        }
 
@@ -453,6 +459,38 @@ _tbm_bo_is_valid(tbm_bo bo)
        return 0;
 }
 
+static void
+_tbm_bo_free(tbm_bo bo)
+{
+       tbm_bufmgr bufmgr = bo->bufmgr;
+
+       /* destory the user_data_list */
+       if (!LIST_IS_EMPTY(&bo->user_data_list)) {
+               tbm_user_data *old_data = NULL, *tmp;
+
+               LIST_FOR_EACH_ENTRY_SAFE(old_data, tmp,
+                               &bo->user_data_list, item_link) {
+                       TBM_DBG("free user_data\n");
+                       user_data_delete(old_data);
+               }
+       }
+
+       while (bo->lock_cnt > 0) {
+               TBM_LOG_E("error lock_cnt:%d\n", bo->lock_cnt);
+               _bo_unlock(bo);
+               bo->lock_cnt--;
+       }
+
+       /* call the bo_free */
+       bufmgr->backend->bo_free(bo);
+       bo->priv = NULL;
+
+       LIST_DEL(&bo->item_link);
+       free(bo);
+
+       bufmgr->bo_cnt--;
+}
+
 /* LCOV_EXCL_START */
 static int
 _check_version(TBMModuleVersionInfo *data)
@@ -716,11 +754,13 @@ tbm_bufmgr_deinit(tbm_bufmgr bufmgr)
 {
        TBM_RETURN_IF_FAIL(TBM_BUFMGR_IS_VALID(bufmgr));
 
+       _tbm_bufmgr_mutex_lock();
        pthread_mutex_lock(&gLock);
 
        if (!gBufMgr) {
                TBM_LOG_E("gBufmgr already destroy: bufmgr:%p\n", bufmgr);
                pthread_mutex_unlock(&gLock);
+               _tbm_bufmgr_mutex_unlock();
                return;
        }
 
@@ -728,6 +768,7 @@ tbm_bufmgr_deinit(tbm_bufmgr bufmgr)
        if (bufmgr->ref_count > 0) {
                TBM_TRACE("reduce a ref_count(%d) of tbm_bufmgr(%p)\n", bufmgr->ref_count, bufmgr);
                pthread_mutex_unlock(&gLock);
+               _tbm_bufmgr_mutex_unlock();
                return;
        }
 
@@ -737,9 +778,9 @@ tbm_bufmgr_deinit(tbm_bufmgr bufmgr)
 
                LIST_FOR_EACH_ENTRY_SAFE(bo, tmp, &bufmgr->bo_list, item_link) {
                        TBM_LOG_E("Un-freed bo(%p, ref:%d)\n", bo, bo->ref_cnt);
-                       bo->ref_cnt = 1;
-                       tbm_bo_unref(bo);
+                       _tbm_bo_free(bo);
                }
+               LIST_DELINIT(&bufmgr->bo_list);
        }
 
        /* destroy surf_list */
@@ -750,6 +791,7 @@ tbm_bufmgr_deinit(tbm_bufmgr bufmgr)
                        TBM_LOG_E("Un-freed surf(%p, ref:%d)\n", surf, surf->refcnt);
                        tbm_surface_destroy(surf);
                }
+               LIST_DELINIT(&bufmgr->surf_list);
        }
 
        /* destroy bufmgr priv */
@@ -769,6 +811,7 @@ tbm_bufmgr_deinit(tbm_bufmgr bufmgr)
        gBufMgr = NULL;
 
        pthread_mutex_unlock(&gLock);
+       _tbm_bufmgr_mutex_unlock();
 }
 
 int
@@ -811,8 +854,6 @@ tbm_bo_ref(tbm_bo bo)
 void
 tbm_bo_unref(tbm_bo bo)
 {
-       tbm_bufmgr bufmgr = gBufMgr;
-
        _tbm_bufmgr_mutex_lock();
 
        TBM_BUFMGR_RETURN_IF_FAIL(gBufMgr);
@@ -826,33 +867,8 @@ tbm_bo_unref(tbm_bo bo)
        }
 
        bo->ref_cnt--;
-       if (bo->ref_cnt == 0) {
-               /* destory the user_data_list */
-               if (!LIST_IS_EMPTY(&bo->user_data_list)) {
-                       tbm_user_data *old_data = NULL, *tmp;
-
-                       LIST_FOR_EACH_ENTRY_SAFE(old_data, tmp,
-                                       &bo->user_data_list, item_link) {
-                               TBM_DBG("free user_data\n");
-                               user_data_delete(old_data);
-                       }
-               }
-
-               while (bo->lock_cnt > 0) {
-                       TBM_LOG_E("error lock_cnt:%d\n", bo->lock_cnt);
-                       _bo_unlock(bo);
-                       bo->lock_cnt--;
-               }
-
-               /* call the bo_free */
-               bufmgr->backend->bo_free(bo);
-               bo->priv = NULL;
-
-               LIST_DEL(&bo->item_link);
-               free(bo);
-
-               bufmgr->bo_cnt--;
-       }
+       if (bo->ref_cnt == 0)
+               _tbm_bo_free(bo);
 
        _tbm_bufmgr_mutex_unlock();
 }
@@ -1483,37 +1499,47 @@ tbm_get_last_error(void)
        return tbm_last_error;
 }
 
-void
-tbm_bufmgr_debug_tbm_info_get(tbm_bufmgr bufmgr, char *str, int *len)
+char *
+tbm_bufmgr_debug_tbm_info_get(tbm_bufmgr bufmgr)
 {
        char app_name[255] = {0,}, title[512] = {0,};
        tbm_surface_debug_data *debug_old_data = NULL;
+       char *str;
+       int len = 1024*4;
+       int c = 0;
 
        pthread_mutex_lock(&gLock);
 
        if (!TBM_BUFMGR_IS_VALID(bufmgr) || (bufmgr != gBufMgr)) {
                TBM_LOG_E("invalid bufmgr\n");
                pthread_mutex_unlock(&gLock);
-               return;
+               return NULL;
+       }
+
+       str = malloc(len);
+       if (!str) {
+               TBM_LOG_E("Fail to allocate the string.\n");
+               pthread_mutex_unlock(&gLock);
+               return NULL;
        }
 
-       TBM_SNPRINTF(str, len, "\n");
+       TBM_SNRPRINTF(str, len, c, "\n");
        _tbm_util_get_appname_from_pid(getpid(), app_name);
        _tbm_util_get_appname_brief(app_name);
-       TBM_SNPRINTF(str, len, "============TBM DEBUG: %s(%d)===========================\n",
+       TBM_SNRPRINTF(str, len, c, "============TBM DEBUG: %s(%d)===========================\n",
                  app_name, getpid());
 
        snprintf(title, 255, "%s", "no  surface     refcnt  width  height  bpp  size    n_b  n_p  flags  format    app_name       ");
 
        if (!LIST_IS_EMPTY(&bufmgr->debug_key_list)) {
                LIST_FOR_EACH_ENTRY(debug_old_data, &bufmgr->debug_key_list, item_link) {
-                       strncat(title, "  ", 3);
-                       strncat(title, debug_old_data->key, strlen(debug_old_data->key) + 1);
+                       strncat(title, "  ", MAX_SIZE_N(title));
+                       strncat(title, debug_old_data->key, MAX_SIZE_N(title));
                }
        }
 
-       TBM_SNPRINTF(str, len, "[tbm_surface information]\n");
-       TBM_SNPRINTF(str, len, "%s\n", title);
+       TBM_SNRPRINTF(str, len, c, "[tbm_surface information]\n");
+       TBM_SNRPRINTF(str, len, c, "%s\n", title);
 
        /* show the tbm_surface information in surf_list */
        if (!LIST_IS_EMPTY(&bufmgr->surf_list)) {
@@ -1553,30 +1579,30 @@ tbm_bufmgr_debug_tbm_info_get(tbm_bufmgr bufmgr, char *str, int *len)
                                LIST_FOR_EACH_ENTRY(debug_old_data, &bufmgr->debug_key_list, item_link) {
                                        char *value;
 
-                                       strncat(data, "  ", 3);
+                                       strncat(data, "  ", MAX_SIZE_N(title));
 
                                        value = _tbm_surface_internal_get_debug_data(surf, debug_old_data->key);
                                        if (value)
-                                               strncat(data, value, strlen(value) + 1);
+                                               strncat(data, value, MAX_SIZE_N(title));
                                        else
-                                               strncat(data, "none", 5);
+                                               strncat(data, "none", MAX_SIZE_N(title));
                                }
                        }
-                       TBM_SNPRINTF(str, len, "%s\n", data);
+                       TBM_SNRPRINTF(str, len, c, "%s\n", data);
 
                        for (i = 0; i < surf->num_bos; i++) {
-                               TBM_SNPRINTF(str, len, " bo:%-12p  %-26d%-10d\n",
+                               TBM_SNRPRINTF(str, len, c, " bo:%-12p  %-26d%-10d\n",
                                          surf->bos[i],
                                          surf->bos[i]->ref_cnt,
                                          bufmgr->backend->bo_size(surf->bos[i]) / 1024);
                        }
                }
        } else
-               TBM_SNPRINTF(str, len, " no tbm_surfaces.\n");
-       TBM_SNPRINTF(str, len, "\n");
+               TBM_SNRPRINTF(str, len, c, " no tbm_surfaces.\n");
+       TBM_SNRPRINTF(str, len, c, "\n");
 
-       TBM_SNPRINTF(str, len, "[tbm_bo information]\n");
-       TBM_SNPRINTF(str, len, "no  bo          refcnt  size    lock_cnt  map_cnt  flags  surface\n");
+       TBM_SNRPRINTF(str, len, c, "[tbm_bo information]\n");
+       TBM_SNRPRINTF(str, len, c, "no  bo          refcnt  size    lock_cnt  map_cnt  flags  surface     name\n");
 
        /* show the tbm_bo information in bo_list */
        if (!LIST_IS_EMPTY(&bufmgr->bo_list)) {
@@ -1584,7 +1610,7 @@ tbm_bufmgr_debug_tbm_info_get(tbm_bufmgr bufmgr, char *str, int *len)
                tbm_bo bo = NULL;
 
                LIST_FOR_EACH_ENTRY(bo, &bufmgr->bo_list, item_link) {
-                       TBM_SNPRINTF(str, len, "%-4d%-11p   %-4d  %-6d     %-5d     %-4u    %-3d  %-11p\n",
+                       TBM_SNRPRINTF(str, len, c, "%-4d%-11p   %-4d  %-6d     %-5d     %-4u    %-3d  %-11p  %-4d\n",
                                  ++bo_cnt,
                                  bo,
                                  bo->ref_cnt,
@@ -1592,24 +1618,29 @@ tbm_bufmgr_debug_tbm_info_get(tbm_bufmgr bufmgr, char *str, int *len)
                                  bo->lock_cnt,
                                  bo->map_cnt,
                                  bo->flags,
-                                 bo->surface);
+                                 bo->surface,
+                                 bufmgr->backend->bo_export(bo));
                }
        } else
-               TBM_SNPRINTF(str, len, "no tbm_bos.\n");
-       TBM_SNPRINTF(str, len, "\n");
+               TBM_SNRPRINTF(str, len, c, "no tbm_bos.\n");
+       TBM_SNRPRINTF(str, len, c, "\n");
 
-       TBM_SNPRINTF(str, len, "===============================================================\n");
+       TBM_SNRPRINTF(str, len, c, "===============================================================\n");
 
        pthread_mutex_unlock(&gLock);
+
+       return str;
 }
 
 void
 tbm_bufmgr_debug_show(tbm_bufmgr bufmgr)
 {
-       char str[1024*4];
-       int len = sizeof(str);
-       tbm_bufmgr_debug_tbm_info_get(bufmgr, str, &len);
-       TBM_DEBUG("     %s", str);
+       char * str;
+       str = tbm_bufmgr_debug_tbm_info_get(bufmgr);
+       if (str) {
+               TBM_DEBUG("     %s", str);
+               free(str);
+       }
 }
 
 void
@@ -1628,6 +1659,14 @@ tbm_bufmgr_debug_trace(tbm_bufmgr bufmgr, int onoff)
        _tbm_bufmgr_mutex_unlock();
 }
 
+void
+tbm_bufmgr_debug_dump_set_scale(double scale)
+{
+       pthread_mutex_lock(&gLock);
+       scale_factor = scale;
+       pthread_mutex_unlock(&gLock);
+}
+
 int
 tbm_bufmgr_debug_queue_dump(char *path, int count, int onoff)
 {
@@ -1653,7 +1692,9 @@ tbm_bufmgr_debug_queue_dump(char *path, int count, int onoff)
                        return 0;
                }
 
-               tbm_surface_internal_dump_start(path, w, h, count);
+               tbm_surface_internal_dump_with_scale_start(path, w, h, count, scale_factor);
+               scale_factor = 0;
+
                b_dump_queue = 1;
        }
 
@@ -1679,7 +1720,8 @@ tbm_bufmgr_debug_dump_all(char *path)
                return 1;
        }
 
-       tbm_surface_internal_dump_start(path, w, h, count);
+       tbm_surface_internal_dump_with_scale_start(path, w, h, count, scale_factor);
+       scale_factor = 0;
 
        LIST_FOR_EACH_ENTRY(surface, &gBufMgr->surf_list, item_link)
                tbm_surface_internal_dump_buffer(surface, "dump_all");