1 /*
2  * Copyright (C) 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define ATRACE_TAG ATRACE_TAG_RESOURCES
18 
19 #include "androidfw/AssetManager2.h"
20 
21 #include <algorithm>
22 #include <iterator>
23 #include <set>
24 
25 #include "android-base/logging.h"
26 #include "android-base/stringprintf.h"
27 #include "utils/ByteOrder.h"
28 #include "utils/Trace.h"
29 
30 #ifdef _WIN32
31 #ifdef ERROR
32 #undef ERROR
33 #endif
34 #endif
35 
36 #include "androidfw/ResourceUtils.h"
37 
38 namespace android {
39 
40 struct FindEntryResult {
41   // A pointer to the resource table entry for this resource.
42   // If the size of the entry is > sizeof(ResTable_entry), it can be cast to
43   // a ResTable_map_entry and processed as a bag/map.
44   const ResTable_entry* entry;
45 
46   // The configuration for which the resulting entry was defined. This is already swapped to host
47   // endianness.
48   ResTable_config config;
49 
50   // The bitmask of configuration axis with which the resource value varies.
51   uint32_t type_flags;
52 
53   // The dynamic package ID map for the package from which this resource came from.
54   const DynamicRefTable* dynamic_ref_table;
55 
56   // The string pool reference to the type's name. This uses a different string pool than
57   // the global string pool, but this is hidden from the caller.
58   StringPoolRef type_string_ref;
59 
60   // The string pool reference to the entry's name. This uses a different string pool than
61   // the global string pool, but this is hidden from the caller.
62   StringPoolRef entry_string_ref;
63 };
64 
AssetManager2()65 AssetManager2::AssetManager2() {
66   memset(&configuration_, 0, sizeof(configuration_));
67 }
68 
SetApkAssets(const std::vector<const ApkAssets * > & apk_assets,bool invalidate_caches)69 bool AssetManager2::SetApkAssets(const std::vector<const ApkAssets*>& apk_assets,
70                                  bool invalidate_caches) {
71   apk_assets_ = apk_assets;
72   BuildDynamicRefTable();
73   RebuildFilterList();
74   if (invalidate_caches) {
75     InvalidateCaches(static_cast<uint32_t>(-1));
76   }
77   return true;
78 }
79 
BuildDynamicRefTable()80 void AssetManager2::BuildDynamicRefTable() {
81   package_groups_.clear();
82   package_ids_.fill(0xff);
83 
84   // 0x01 is reserved for the android package.
85   int next_package_id = 0x02;
86   const size_t apk_assets_count = apk_assets_.size();
87   for (size_t i = 0; i < apk_assets_count; i++) {
88     const LoadedArsc* loaded_arsc = apk_assets_[i]->GetLoadedArsc();
89 
90     for (const std::unique_ptr<const LoadedPackage>& package : loaded_arsc->GetPackages()) {
91       // Get the package ID or assign one if a shared library.
92       int package_id;
93       if (package->IsDynamic()) {
94         package_id = next_package_id++;
95       } else {
96         package_id = package->GetPackageId();
97       }
98 
99       // Add the mapping for package ID to index if not present.
100       uint8_t idx = package_ids_[package_id];
101       if (idx == 0xff) {
102         package_ids_[package_id] = idx = static_cast<uint8_t>(package_groups_.size());
103         package_groups_.push_back({});
104         DynamicRefTable& ref_table = package_groups_.back().dynamic_ref_table;
105         ref_table.mAssignedPackageId = package_id;
106         ref_table.mAppAsLib = package->IsDynamic() && package->GetPackageId() == 0x7f;
107       }
108       PackageGroup* package_group = &package_groups_[idx];
109 
110       // Add the package and to the set of packages with the same ID.
111       package_group->packages_.push_back(ConfiguredPackage{package.get(), {}});
112       package_group->cookies_.push_back(static_cast<ApkAssetsCookie>(i));
113 
114       // Add the package name -> build time ID mappings.
115       for (const DynamicPackageEntry& entry : package->GetDynamicPackageMap()) {
116         String16 package_name(entry.package_name.c_str(), entry.package_name.size());
117         package_group->dynamic_ref_table.mEntries.replaceValueFor(
118             package_name, static_cast<uint8_t>(entry.package_id));
119       }
120     }
121   }
122 
123   // Now assign the runtime IDs so that we have a build-time to runtime ID map.
124   const auto package_groups_end = package_groups_.end();
125   for (auto iter = package_groups_.begin(); iter != package_groups_end; ++iter) {
126     const std::string& package_name = iter->packages_[0].loaded_package_->GetPackageName();
127     for (auto iter2 = package_groups_.begin(); iter2 != package_groups_end; ++iter2) {
128       iter2->dynamic_ref_table.addMapping(String16(package_name.c_str(), package_name.size()),
129                                           iter->dynamic_ref_table.mAssignedPackageId);
130     }
131   }
132 }
133 
DumpToLog() const134 void AssetManager2::DumpToLog() const {
135   base::ScopedLogSeverity _log(base::INFO);
136 
137   LOG(INFO) << base::StringPrintf("AssetManager2(this=%p)", this);
138 
139   std::string list;
140   for (const auto& apk_assets : apk_assets_) {
141     base::StringAppendF(&list, "%s,", apk_assets->GetPath().c_str());
142   }
143   LOG(INFO) << "ApkAssets: " << list;
144 
145   list = "";
146   for (size_t i = 0; i < package_ids_.size(); i++) {
147     if (package_ids_[i] != 0xff) {
148       base::StringAppendF(&list, "%02x -> %d, ", (int)i, package_ids_[i]);
149     }
150   }
151   LOG(INFO) << "Package ID map: " << list;
152 
153   for (const auto& package_group: package_groups_) {
154     list = "";
155     for (const auto& package : package_group.packages_) {
156       const LoadedPackage* loaded_package = package.loaded_package_;
157       base::StringAppendF(&list, "%s(%02x%s), ", loaded_package->GetPackageName().c_str(),
158                           loaded_package->GetPackageId(),
159                           (loaded_package->IsDynamic() ? " dynamic" : ""));
160     }
161     LOG(INFO) << base::StringPrintf("PG (%02x): ",
162                                     package_group.dynamic_ref_table.mAssignedPackageId)
163               << list;
164   }
165 }
166 
GetStringPoolForCookie(ApkAssetsCookie cookie) const167 const ResStringPool* AssetManager2::GetStringPoolForCookie(ApkAssetsCookie cookie) const {
168   if (cookie < 0 || static_cast<size_t>(cookie) >= apk_assets_.size()) {
169     return nullptr;
170   }
171   return apk_assets_[cookie]->GetLoadedArsc()->GetStringPool();
172 }
173 
GetDynamicRefTableForPackage(uint32_t package_id) const174 const DynamicRefTable* AssetManager2::GetDynamicRefTableForPackage(uint32_t package_id) const {
175   if (package_id >= package_ids_.size()) {
176     return nullptr;
177   }
178 
179   const size_t idx = package_ids_[package_id];
180   if (idx == 0xff) {
181     return nullptr;
182   }
183   return &package_groups_[idx].dynamic_ref_table;
184 }
185 
GetDynamicRefTableForCookie(ApkAssetsCookie cookie) const186 const DynamicRefTable* AssetManager2::GetDynamicRefTableForCookie(ApkAssetsCookie cookie) const {
187   for (const PackageGroup& package_group : package_groups_) {
188     for (const ApkAssetsCookie& package_cookie : package_group.cookies_) {
189       if (package_cookie == cookie) {
190         return &package_group.dynamic_ref_table;
191       }
192     }
193   }
194   return nullptr;
195 }
196 
SetConfiguration(const ResTable_config & configuration)197 void AssetManager2::SetConfiguration(const ResTable_config& configuration) {
198   const int diff = configuration_.diff(configuration);
199   configuration_ = configuration;
200 
201   if (diff) {
202     RebuildFilterList();
203     InvalidateCaches(static_cast<uint32_t>(diff));
204   }
205 }
206 
GetResourceConfigurations(bool exclude_system,bool exclude_mipmap) const207 std::set<ResTable_config> AssetManager2::GetResourceConfigurations(bool exclude_system,
208                                                                    bool exclude_mipmap) const {
209   ATRACE_NAME("AssetManager::GetResourceConfigurations");
210   std::set<ResTable_config> configurations;
211   for (const PackageGroup& package_group : package_groups_) {
212     for (const ConfiguredPackage& package : package_group.packages_) {
213       if (exclude_system && package.loaded_package_->IsSystem()) {
214         continue;
215       }
216       package.loaded_package_->CollectConfigurations(exclude_mipmap, &configurations);
217     }
218   }
219   return configurations;
220 }
221 
GetResourceLocales(bool exclude_system,bool merge_equivalent_languages) const222 std::set<std::string> AssetManager2::GetResourceLocales(bool exclude_system,
223                                                         bool merge_equivalent_languages) const {
224   ATRACE_NAME("AssetManager::GetResourceLocales");
225   std::set<std::string> locales;
226   for (const PackageGroup& package_group : package_groups_) {
227     for (const ConfiguredPackage& package : package_group.packages_) {
228       if (exclude_system && package.loaded_package_->IsSystem()) {
229         continue;
230       }
231       package.loaded_package_->CollectLocales(merge_equivalent_languages, &locales);
232     }
233   }
234   return locales;
235 }
236 
Open(const std::string & filename,Asset::AccessMode mode) const237 std::unique_ptr<Asset> AssetManager2::Open(const std::string& filename,
238                                            Asset::AccessMode mode) const {
239   const std::string new_path = "assets/" + filename;
240   return OpenNonAsset(new_path, mode);
241 }
242 
Open(const std::string & filename,ApkAssetsCookie cookie,Asset::AccessMode mode) const243 std::unique_ptr<Asset> AssetManager2::Open(const std::string& filename, ApkAssetsCookie cookie,
244                                            Asset::AccessMode mode) const {
245   const std::string new_path = "assets/" + filename;
246   return OpenNonAsset(new_path, cookie, mode);
247 }
248 
OpenDir(const std::string & dirname) const249 std::unique_ptr<AssetDir> AssetManager2::OpenDir(const std::string& dirname) const {
250   ATRACE_NAME("AssetManager::OpenDir");
251 
252   std::string full_path = "assets/" + dirname;
253   std::unique_ptr<SortedVector<AssetDir::FileInfo>> files =
254       util::make_unique<SortedVector<AssetDir::FileInfo>>();
255 
256   // Start from the back.
257   for (auto iter = apk_assets_.rbegin(); iter != apk_assets_.rend(); ++iter) {
258     const ApkAssets* apk_assets = *iter;
259 
260     auto func = [&](const StringPiece& name, FileType type) {
261       AssetDir::FileInfo info;
262       info.setFileName(String8(name.data(), name.size()));
263       info.setFileType(type);
264       info.setSourceName(String8(apk_assets->GetPath().c_str()));
265       files->add(info);
266     };
267 
268     if (!apk_assets->ForEachFile(full_path, func)) {
269       return {};
270     }
271   }
272 
273   std::unique_ptr<AssetDir> asset_dir = util::make_unique<AssetDir>();
274   asset_dir->setFileList(files.release());
275   return asset_dir;
276 }
277 
278 // Search in reverse because that's how we used to do it and we need to preserve behaviour.
279 // This is unfortunate, because ClassLoaders delegate to the parent first, so the order
280 // is inconsistent for split APKs.
OpenNonAsset(const std::string & filename,Asset::AccessMode mode,ApkAssetsCookie * out_cookie) const281 std::unique_ptr<Asset> AssetManager2::OpenNonAsset(const std::string& filename,
282                                                    Asset::AccessMode mode,
283                                                    ApkAssetsCookie* out_cookie) const {
284   for (int32_t i = apk_assets_.size() - 1; i >= 0; i--) {
285     std::unique_ptr<Asset> asset = apk_assets_[i]->Open(filename, mode);
286     if (asset) {
287       if (out_cookie != nullptr) {
288         *out_cookie = i;
289       }
290       return asset;
291     }
292   }
293 
294   if (out_cookie != nullptr) {
295     *out_cookie = kInvalidCookie;
296   }
297   return {};
298 }
299 
OpenNonAsset(const std::string & filename,ApkAssetsCookie cookie,Asset::AccessMode mode) const300 std::unique_ptr<Asset> AssetManager2::OpenNonAsset(const std::string& filename,
301                                                    ApkAssetsCookie cookie,
302                                                    Asset::AccessMode mode) const {
303   if (cookie < 0 || static_cast<size_t>(cookie) >= apk_assets_.size()) {
304     return {};
305   }
306   return apk_assets_[cookie]->Open(filename, mode);
307 }
308 
FindEntry(uint32_t resid,uint16_t density_override,bool,FindEntryResult * out_entry) const309 ApkAssetsCookie AssetManager2::FindEntry(uint32_t resid, uint16_t density_override,
310                                          bool /*stop_at_first_match*/,
311                                          FindEntryResult* out_entry) const {
312   // Might use this if density_override != 0.
313   ResTable_config density_override_config;
314 
315   // Select our configuration or generate a density override configuration.
316   const ResTable_config* desired_config = &configuration_;
317   if (density_override != 0 && density_override != configuration_.density) {
318     density_override_config = configuration_;
319     density_override_config.density = density_override;
320     desired_config = &density_override_config;
321   }
322 
323   if (!is_valid_resid(resid)) {
324     LOG(ERROR) << base::StringPrintf("Invalid ID 0x%08x.", resid);
325     return kInvalidCookie;
326   }
327 
328   const uint32_t package_id = get_package_id(resid);
329   const uint8_t type_idx = get_type_id(resid) - 1;
330   const uint16_t entry_idx = get_entry_id(resid);
331 
332   const uint8_t package_idx = package_ids_[package_id];
333   if (package_idx == 0xff) {
334     LOG(ERROR) << base::StringPrintf("No package ID %02x found for ID 0x%08x.", package_id, resid);
335     return kInvalidCookie;
336   }
337 
338   const PackageGroup& package_group = package_groups_[package_idx];
339   const size_t package_count = package_group.packages_.size();
340 
341   ApkAssetsCookie best_cookie = kInvalidCookie;
342   const LoadedPackage* best_package = nullptr;
343   const ResTable_type* best_type = nullptr;
344   const ResTable_config* best_config = nullptr;
345   ResTable_config best_config_copy;
346   uint32_t best_offset = 0u;
347   uint32_t type_flags = 0u;
348 
349   // If desired_config is the same as the set configuration, then we can use our filtered list
350   // and we don't need to match the configurations, since they already matched.
351   const bool use_fast_path = desired_config == &configuration_;
352 
353   for (size_t pi = 0; pi < package_count; pi++) {
354     const ConfiguredPackage& loaded_package_impl = package_group.packages_[pi];
355     const LoadedPackage* loaded_package = loaded_package_impl.loaded_package_;
356     ApkAssetsCookie cookie = package_group.cookies_[pi];
357 
358     // If the type IDs are offset in this package, we need to take that into account when searching
359     // for a type.
360     const TypeSpec* type_spec = loaded_package->GetTypeSpecByTypeIndex(type_idx);
361     if (UNLIKELY(type_spec == nullptr)) {
362       continue;
363     }
364 
365     uint16_t local_entry_idx = entry_idx;
366 
367     // If there is an IDMAP supplied with this package, translate the entry ID.
368     if (type_spec->idmap_entries != nullptr) {
369       if (!LoadedIdmap::Lookup(type_spec->idmap_entries, local_entry_idx, &local_entry_idx)) {
370         // There is no mapping, so the resource is not meant to be in this overlay package.
371         continue;
372       }
373     }
374 
375     type_flags |= type_spec->GetFlagsForEntryIndex(local_entry_idx);
376 
377     // If the package is an overlay, then even configurations that are the same MUST be chosen.
378     const bool package_is_overlay = loaded_package->IsOverlay();
379 
380     const FilteredConfigGroup& filtered_group = loaded_package_impl.filtered_configs_[type_idx];
381     if (use_fast_path) {
382       const std::vector<ResTable_config>& candidate_configs = filtered_group.configurations;
383       const size_t type_count = candidate_configs.size();
384       for (uint32_t i = 0; i < type_count; i++) {
385         const ResTable_config& this_config = candidate_configs[i];
386 
387         // We can skip calling ResTable_config::match() because we know that all candidate
388         // configurations that do NOT match have been filtered-out.
389         if ((best_config == nullptr || this_config.isBetterThan(*best_config, desired_config)) ||
390             (package_is_overlay && this_config.compare(*best_config) == 0)) {
391           // The configuration matches and is better than the previous selection.
392           // Find the entry value if it exists for this configuration.
393           const ResTable_type* type_chunk = filtered_group.types[i];
394           const uint32_t offset = LoadedPackage::GetEntryOffset(type_chunk, local_entry_idx);
395           if (offset == ResTable_type::NO_ENTRY) {
396             continue;
397           }
398 
399           best_cookie = cookie;
400           best_package = loaded_package;
401           best_type = type_chunk;
402           best_config = &this_config;
403           best_offset = offset;
404         }
405       }
406     } else {
407       // This is the slower path, which doesn't use the filtered list of configurations.
408       // Here we must read the ResTable_config from the mmapped APK, convert it to host endianness
409       // and fill in any new fields that did not exist when the APK was compiled.
410       // Furthermore when selecting configurations we can't just record the pointer to the
411       // ResTable_config, we must copy it.
412       const auto iter_end = type_spec->types + type_spec->type_count;
413       for (auto iter = type_spec->types; iter != iter_end; ++iter) {
414         ResTable_config this_config;
415         this_config.copyFromDtoH((*iter)->config);
416 
417         if (this_config.match(*desired_config)) {
418           if ((best_config == nullptr || this_config.isBetterThan(*best_config, desired_config)) ||
419               (package_is_overlay && this_config.compare(*best_config) == 0)) {
420             // The configuration matches and is better than the previous selection.
421             // Find the entry value if it exists for this configuration.
422             const uint32_t offset = LoadedPackage::GetEntryOffset(*iter, local_entry_idx);
423             if (offset == ResTable_type::NO_ENTRY) {
424               continue;
425             }
426 
427             best_cookie = cookie;
428             best_package = loaded_package;
429             best_type = *iter;
430             best_config_copy = this_config;
431             best_config = &best_config_copy;
432             best_offset = offset;
433           }
434         }
435       }
436     }
437   }
438 
439   if (UNLIKELY(best_cookie == kInvalidCookie)) {
440     return kInvalidCookie;
441   }
442 
443   const ResTable_entry* best_entry = LoadedPackage::GetEntryFromOffset(best_type, best_offset);
444   if (UNLIKELY(best_entry == nullptr)) {
445     return kInvalidCookie;
446   }
447 
448   out_entry->entry = best_entry;
449   out_entry->config = *best_config;
450   out_entry->type_flags = type_flags;
451   out_entry->type_string_ref = StringPoolRef(best_package->GetTypeStringPool(), best_type->id - 1);
452   out_entry->entry_string_ref =
453       StringPoolRef(best_package->GetKeyStringPool(), best_entry->key.index);
454   out_entry->dynamic_ref_table = &package_group.dynamic_ref_table;
455   return best_cookie;
456 }
457 
GetResourceName(uint32_t resid,ResourceName * out_name) const458 bool AssetManager2::GetResourceName(uint32_t resid, ResourceName* out_name) const {
459   FindEntryResult entry;
460   ApkAssetsCookie cookie =
461       FindEntry(resid, 0u /* density_override */, true /* stop_at_first_match */, &entry);
462   if (cookie == kInvalidCookie) {
463     return false;
464   }
465 
466   const LoadedPackage* package =
467       apk_assets_[cookie]->GetLoadedArsc()->GetPackageById(get_package_id(resid));
468   if (package == nullptr) {
469     return false;
470   }
471 
472   out_name->package = package->GetPackageName().data();
473   out_name->package_len = package->GetPackageName().size();
474 
475   out_name->type = entry.type_string_ref.string8(&out_name->type_len);
476   out_name->type16 = nullptr;
477   if (out_name->type == nullptr) {
478     out_name->type16 = entry.type_string_ref.string16(&out_name->type_len);
479     if (out_name->type16 == nullptr) {
480       return false;
481     }
482   }
483 
484   out_name->entry = entry.entry_string_ref.string8(&out_name->entry_len);
485   out_name->entry16 = nullptr;
486   if (out_name->entry == nullptr) {
487     out_name->entry16 = entry.entry_string_ref.string16(&out_name->entry_len);
488     if (out_name->entry16 == nullptr) {
489       return false;
490     }
491   }
492   return true;
493 }
494 
GetResourceFlags(uint32_t resid,uint32_t * out_flags) const495 bool AssetManager2::GetResourceFlags(uint32_t resid, uint32_t* out_flags) const {
496   FindEntryResult entry;
497   ApkAssetsCookie cookie =
498       FindEntry(resid, 0u /* density_override */, false /* stop_at_first_match */, &entry);
499   if (cookie != kInvalidCookie) {
500     *out_flags = entry.type_flags;
501     return cookie;
502   }
503   return kInvalidCookie;
504 }
505 
GetResource(uint32_t resid,bool may_be_bag,uint16_t density_override,Res_value * out_value,ResTable_config * out_selected_config,uint32_t * out_flags) const506 ApkAssetsCookie AssetManager2::GetResource(uint32_t resid, bool may_be_bag,
507                                            uint16_t density_override, Res_value* out_value,
508                                            ResTable_config* out_selected_config,
509                                            uint32_t* out_flags) const {
510   FindEntryResult entry;
511   ApkAssetsCookie cookie =
512       FindEntry(resid, density_override, false /* stop_at_first_match */, &entry);
513   if (cookie == kInvalidCookie) {
514     return kInvalidCookie;
515   }
516 
517   if (dtohs(entry.entry->flags) & ResTable_entry::FLAG_COMPLEX) {
518     if (!may_be_bag) {
519       LOG(ERROR) << base::StringPrintf("Resource %08x is a complex map type.", resid);
520       return kInvalidCookie;
521     }
522 
523     // Create a reference since we can't represent this complex type as a Res_value.
524     out_value->dataType = Res_value::TYPE_REFERENCE;
525     out_value->data = resid;
526     *out_selected_config = entry.config;
527     *out_flags = entry.type_flags;
528     return cookie;
529   }
530 
531   const Res_value* device_value = reinterpret_cast<const Res_value*>(
532       reinterpret_cast<const uint8_t*>(entry.entry) + dtohs(entry.entry->size));
533   out_value->copyFrom_dtoh(*device_value);
534 
535   // Convert the package ID to the runtime assigned package ID.
536   entry.dynamic_ref_table->lookupResourceValue(out_value);
537 
538   *out_selected_config = entry.config;
539   *out_flags = entry.type_flags;
540   return cookie;
541 }
542 
ResolveReference(ApkAssetsCookie cookie,Res_value * in_out_value,ResTable_config * in_out_selected_config,uint32_t * in_out_flags,uint32_t * out_last_reference) const543 ApkAssetsCookie AssetManager2::ResolveReference(ApkAssetsCookie cookie, Res_value* in_out_value,
544                                                 ResTable_config* in_out_selected_config,
545                                                 uint32_t* in_out_flags,
546                                                 uint32_t* out_last_reference) const {
547   constexpr const int kMaxIterations = 20;
548 
549   for (size_t iteration = 0u; in_out_value->dataType == Res_value::TYPE_REFERENCE &&
550                               in_out_value->data != 0u && iteration < kMaxIterations;
551        iteration++) {
552     *out_last_reference = in_out_value->data;
553     uint32_t new_flags = 0u;
554     cookie = GetResource(in_out_value->data, true /*may_be_bag*/, 0u /*density_override*/,
555                          in_out_value, in_out_selected_config, &new_flags);
556     if (cookie == kInvalidCookie) {
557       return kInvalidCookie;
558     }
559     if (in_out_flags != nullptr) {
560       *in_out_flags |= new_flags;
561     }
562     if (*out_last_reference == in_out_value->data) {
563       // This reference can't be resolved, so exit now and let the caller deal with it.
564       return cookie;
565     }
566   }
567   return cookie;
568 }
569 
GetBag(uint32_t resid)570 const ResolvedBag* AssetManager2::GetBag(uint32_t resid) {
571   auto found_resids = std::vector<uint32_t>();
572   return GetBag(resid, found_resids);
573 }
574 
GetBag(uint32_t resid,std::vector<uint32_t> & child_resids)575 const ResolvedBag* AssetManager2::GetBag(uint32_t resid, std::vector<uint32_t>& child_resids) {
576   ATRACE_NAME("AssetManager::GetBag");
577 
578   auto cached_iter = cached_bags_.find(resid);
579   if (cached_iter != cached_bags_.end()) {
580     return cached_iter->second.get();
581   }
582 
583   FindEntryResult entry;
584   ApkAssetsCookie cookie =
585       FindEntry(resid, 0u /* density_override */, false /* stop_at_first_match */, &entry);
586   if (cookie == kInvalidCookie) {
587     return nullptr;
588   }
589 
590   // Check that the size of the entry header is at least as big as
591   // the desired ResTable_map_entry. Also verify that the entry
592   // was intended to be a map.
593   if (dtohs(entry.entry->size) < sizeof(ResTable_map_entry) ||
594       (dtohs(entry.entry->flags) & ResTable_entry::FLAG_COMPLEX) == 0) {
595     // Not a bag, nothing to do.
596     return nullptr;
597   }
598 
599   const ResTable_map_entry* map = reinterpret_cast<const ResTable_map_entry*>(entry.entry);
600   const ResTable_map* map_entry =
601       reinterpret_cast<const ResTable_map*>(reinterpret_cast<const uint8_t*>(map) + map->size);
602   const ResTable_map* const map_entry_end = map_entry + dtohl(map->count);
603 
604   // Keep track of ids that have already been seen to prevent infinite loops caused by circular
605   // dependencies between bags
606   child_resids.push_back(resid);
607 
608   uint32_t parent_resid = dtohl(map->parent.ident);
609   if (parent_resid == 0 || std::find(child_resids.begin(), child_resids.end(), parent_resid)
610       != child_resids.end()) {
611     // There is no parent or that a circular dependency exist, meaning there is nothing to
612     // inherit and we can do a simple copy of the entries in the map.
613     const size_t entry_count = map_entry_end - map_entry;
614     util::unique_cptr<ResolvedBag> new_bag{reinterpret_cast<ResolvedBag*>(
615         malloc(sizeof(ResolvedBag) + (entry_count * sizeof(ResolvedBag::Entry))))};
616     ResolvedBag::Entry* new_entry = new_bag->entries;
617     for (; map_entry != map_entry_end; ++map_entry) {
618       uint32_t new_key = dtohl(map_entry->name.ident);
619       if (!is_internal_resid(new_key)) {
620         // Attributes, arrays, etc don't have a resource id as the name. They specify
621         // other data, which would be wrong to change via a lookup.
622         if (entry.dynamic_ref_table->lookupResourceId(&new_key) != NO_ERROR) {
623           LOG(ERROR) << base::StringPrintf("Failed to resolve key 0x%08x in bag 0x%08x.", new_key,
624                                            resid);
625           return nullptr;
626         }
627       }
628       new_entry->cookie = cookie;
629       new_entry->key = new_key;
630       new_entry->key_pool = nullptr;
631       new_entry->type_pool = nullptr;
632       new_entry->value.copyFrom_dtoh(map_entry->value);
633       status_t err = entry.dynamic_ref_table->lookupResourceValue(&new_entry->value);
634       if (err != NO_ERROR) {
635         LOG(ERROR) << base::StringPrintf(
636             "Failed to resolve value t=0x%02x d=0x%08x for key 0x%08x.", new_entry->value.dataType,
637             new_entry->value.data, new_key);
638         return nullptr;
639       }
640       ++new_entry;
641     }
642     new_bag->type_spec_flags = entry.type_flags;
643     new_bag->entry_count = static_cast<uint32_t>(entry_count);
644     ResolvedBag* result = new_bag.get();
645     cached_bags_[resid] = std::move(new_bag);
646     return result;
647   }
648 
649   // In case the parent is a dynamic reference, resolve it.
650   entry.dynamic_ref_table->lookupResourceId(&parent_resid);
651 
652   // Get the parent and do a merge of the keys.
653   const ResolvedBag* parent_bag = GetBag(parent_resid, child_resids);
654   if (parent_bag == nullptr) {
655     // Failed to get the parent that should exist.
656     LOG(ERROR) << base::StringPrintf("Failed to find parent 0x%08x of bag 0x%08x.", parent_resid,
657                                      resid);
658     return nullptr;
659   }
660 
661   // Create the max possible entries we can make. Once we construct the bag,
662   // we will realloc to fit to size.
663   const size_t max_count = parent_bag->entry_count + dtohl(map->count);
664   util::unique_cptr<ResolvedBag> new_bag{reinterpret_cast<ResolvedBag*>(
665       malloc(sizeof(ResolvedBag) + (max_count * sizeof(ResolvedBag::Entry))))};
666   ResolvedBag::Entry* new_entry = new_bag->entries;
667 
668   const ResolvedBag::Entry* parent_entry = parent_bag->entries;
669   const ResolvedBag::Entry* const parent_entry_end = parent_entry + parent_bag->entry_count;
670 
671   // The keys are expected to be in sorted order. Merge the two bags.
672   while (map_entry != map_entry_end && parent_entry != parent_entry_end) {
673     uint32_t child_key = dtohl(map_entry->name.ident);
674     if (!is_internal_resid(child_key)) {
675       if (entry.dynamic_ref_table->lookupResourceId(&child_key) != NO_ERROR) {
676         LOG(ERROR) << base::StringPrintf("Failed to resolve key 0x%08x in bag 0x%08x.", child_key,
677                                          resid);
678         return nullptr;
679       }
680     }
681 
682     if (child_key <= parent_entry->key) {
683       // Use the child key if it comes before the parent
684       // or is equal to the parent (overrides).
685       new_entry->cookie = cookie;
686       new_entry->key = child_key;
687       new_entry->key_pool = nullptr;
688       new_entry->type_pool = nullptr;
689       new_entry->value.copyFrom_dtoh(map_entry->value);
690       status_t err = entry.dynamic_ref_table->lookupResourceValue(&new_entry->value);
691       if (err != NO_ERROR) {
692         LOG(ERROR) << base::StringPrintf(
693             "Failed to resolve value t=0x%02x d=0x%08x for key 0x%08x.", new_entry->value.dataType,
694             new_entry->value.data, child_key);
695         return nullptr;
696       }
697       ++map_entry;
698     } else {
699       // Take the parent entry as-is.
700       memcpy(new_entry, parent_entry, sizeof(*new_entry));
701     }
702 
703     if (child_key >= parent_entry->key) {
704       // Move to the next parent entry if we used it or it was overridden.
705       ++parent_entry;
706     }
707     // Increment to the next entry to fill.
708     ++new_entry;
709   }
710 
711   // Finish the child entries if they exist.
712   while (map_entry != map_entry_end) {
713     uint32_t new_key = dtohl(map_entry->name.ident);
714     if (!is_internal_resid(new_key)) {
715       if (entry.dynamic_ref_table->lookupResourceId(&new_key) != NO_ERROR) {
716         LOG(ERROR) << base::StringPrintf("Failed to resolve key 0x%08x in bag 0x%08x.", new_key,
717                                          resid);
718         return nullptr;
719       }
720     }
721     new_entry->cookie = cookie;
722     new_entry->key = new_key;
723     new_entry->key_pool = nullptr;
724     new_entry->type_pool = nullptr;
725     new_entry->value.copyFrom_dtoh(map_entry->value);
726     status_t err = entry.dynamic_ref_table->lookupResourceValue(&new_entry->value);
727     if (err != NO_ERROR) {
728       LOG(ERROR) << base::StringPrintf("Failed to resolve value t=0x%02x d=0x%08x for key 0x%08x.",
729                                        new_entry->value.dataType, new_entry->value.data, new_key);
730       return nullptr;
731     }
732     ++map_entry;
733     ++new_entry;
734   }
735 
736   // Finish the parent entries if they exist.
737   if (parent_entry != parent_entry_end) {
738     // Take the rest of the parent entries as-is.
739     const size_t num_entries_to_copy = parent_entry_end - parent_entry;
740     memcpy(new_entry, parent_entry, num_entries_to_copy * sizeof(*new_entry));
741     new_entry += num_entries_to_copy;
742   }
743 
744   // Resize the resulting array to fit.
745   const size_t actual_count = new_entry - new_bag->entries;
746   if (actual_count != max_count) {
747     new_bag.reset(reinterpret_cast<ResolvedBag*>(realloc(
748         new_bag.release(), sizeof(ResolvedBag) + (actual_count * sizeof(ResolvedBag::Entry)))));
749   }
750 
751   // Combine flags from the parent and our own bag.
752   new_bag->type_spec_flags = entry.type_flags | parent_bag->type_spec_flags;
753   new_bag->entry_count = static_cast<uint32_t>(actual_count);
754   ResolvedBag* result = new_bag.get();
755   cached_bags_[resid] = std::move(new_bag);
756   return result;
757 }
758 
Utf8ToUtf16(const StringPiece & str,std::u16string * out)759 static bool Utf8ToUtf16(const StringPiece& str, std::u16string* out) {
760   ssize_t len =
761       utf8_to_utf16_length(reinterpret_cast<const uint8_t*>(str.data()), str.size(), false);
762   if (len < 0) {
763     return false;
764   }
765   out->resize(static_cast<size_t>(len));
766   utf8_to_utf16(reinterpret_cast<const uint8_t*>(str.data()), str.size(), &*out->begin(),
767                 static_cast<size_t>(len + 1));
768   return true;
769 }
770 
GetResourceId(const std::string & resource_name,const std::string & fallback_type,const std::string & fallback_package) const771 uint32_t AssetManager2::GetResourceId(const std::string& resource_name,
772                                       const std::string& fallback_type,
773                                       const std::string& fallback_package) const {
774   StringPiece package_name, type, entry;
775   if (!ExtractResourceName(resource_name, &package_name, &type, &entry)) {
776     return 0u;
777   }
778 
779   if (entry.empty()) {
780     return 0u;
781   }
782 
783   if (package_name.empty()) {
784     package_name = fallback_package;
785   }
786 
787   if (type.empty()) {
788     type = fallback_type;
789   }
790 
791   std::u16string type16;
792   if (!Utf8ToUtf16(type, &type16)) {
793     return 0u;
794   }
795 
796   std::u16string entry16;
797   if (!Utf8ToUtf16(entry, &entry16)) {
798     return 0u;
799   }
800 
801   const StringPiece16 kAttr16 = u"attr";
802   const static std::u16string kAttrPrivate16 = u"^attr-private";
803 
804   for (const PackageGroup& package_group : package_groups_) {
805     for (const ConfiguredPackage& package_impl : package_group.packages_) {
806       const LoadedPackage* package = package_impl.loaded_package_;
807       if (package_name != package->GetPackageName()) {
808         // All packages in the same group are expected to have the same package name.
809         break;
810       }
811 
812       uint32_t resid = package->FindEntryByName(type16, entry16);
813       if (resid == 0u && kAttr16 == type16) {
814         // Private attributes in libraries (such as the framework) are sometimes encoded
815         // under the type '^attr-private' in order to leave the ID space of public 'attr'
816         // free for future additions. Check '^attr-private' for the same name.
817         resid = package->FindEntryByName(kAttrPrivate16, entry16);
818       }
819 
820       if (resid != 0u) {
821         return fix_package_id(resid, package_group.dynamic_ref_table.mAssignedPackageId);
822       }
823     }
824   }
825   return 0u;
826 }
827 
RebuildFilterList()828 void AssetManager2::RebuildFilterList() {
829   for (PackageGroup& group : package_groups_) {
830     for (ConfiguredPackage& impl : group.packages_) {
831       // Destroy it.
832       impl.filtered_configs_.~ByteBucketArray();
833 
834       // Re-create it.
835       new (&impl.filtered_configs_) ByteBucketArray<FilteredConfigGroup>();
836 
837       // Create the filters here.
838       impl.loaded_package_->ForEachTypeSpec([&](const TypeSpec* spec, uint8_t type_index) {
839         FilteredConfigGroup& group = impl.filtered_configs_.editItemAt(type_index);
840         const auto iter_end = spec->types + spec->type_count;
841         for (auto iter = spec->types; iter != iter_end; ++iter) {
842           ResTable_config this_config;
843           this_config.copyFromDtoH((*iter)->config);
844           if (this_config.match(configuration_)) {
845             group.configurations.push_back(this_config);
846             group.types.push_back(*iter);
847           }
848         }
849       });
850     }
851   }
852 }
853 
InvalidateCaches(uint32_t diff)854 void AssetManager2::InvalidateCaches(uint32_t diff) {
855   if (diff == 0xffffffffu) {
856     // Everything must go.
857     cached_bags_.clear();
858     return;
859   }
860 
861   // Be more conservative with what gets purged. Only if the bag has other possible
862   // variations with respect to what changed (diff) should we remove it.
863   for (auto iter = cached_bags_.cbegin(); iter != cached_bags_.cend();) {
864     if (diff & iter->second->type_spec_flags) {
865       iter = cached_bags_.erase(iter);
866     } else {
867       ++iter;
868     }
869   }
870 }
871 
NewTheme()872 std::unique_ptr<Theme> AssetManager2::NewTheme() {
873   return std::unique_ptr<Theme>(new Theme(this));
874 }
875 
Theme(AssetManager2 * asset_manager)876 Theme::Theme(AssetManager2* asset_manager) : asset_manager_(asset_manager) {
877 }
878 
879 Theme::~Theme() = default;
880 
881 namespace {
882 
883 struct ThemeEntry {
884   ApkAssetsCookie cookie;
885   uint32_t type_spec_flags;
886   Res_value value;
887 };
888 
889 struct ThemeType {
890   int entry_count;
891   ThemeEntry entries[0];
892 };
893 
894 constexpr size_t kTypeCount = std::numeric_limits<uint8_t>::max() + 1;
895 
896 }  // namespace
897 
898 struct Theme::Package {
899   // Each element of Type will be a dynamically sized object
900   // allocated to have the entries stored contiguously with the Type.
901   std::array<util::unique_cptr<ThemeType>, kTypeCount> types;
902 };
903 
ApplyStyle(uint32_t resid,bool force)904 bool Theme::ApplyStyle(uint32_t resid, bool force) {
905   ATRACE_NAME("Theme::ApplyStyle");
906 
907   const ResolvedBag* bag = asset_manager_->GetBag(resid);
908   if (bag == nullptr) {
909     return false;
910   }
911 
912   // Merge the flags from this style.
913   type_spec_flags_ |= bag->type_spec_flags;
914 
915   int last_type_idx = -1;
916   int last_package_idx = -1;
917   Package* last_package = nullptr;
918   ThemeType* last_type = nullptr;
919 
920   // Iterate backwards, because each bag is sorted in ascending key ID order, meaning we will only
921   // need to perform one resize per type.
922   using reverse_bag_iterator = std::reverse_iterator<const ResolvedBag::Entry*>;
923   const auto bag_iter_end = reverse_bag_iterator(begin(bag));
924   for (auto bag_iter = reverse_bag_iterator(end(bag)); bag_iter != bag_iter_end; ++bag_iter) {
925     const uint32_t attr_resid = bag_iter->key;
926 
927     // If the resource ID passed in is not a style, the key can be some other identifier that is not
928     // a resource ID. We should fail fast instead of operating with strange resource IDs.
929     if (!is_valid_resid(attr_resid)) {
930       return false;
931     }
932 
933     // We don't use the 0-based index for the type so that we can avoid doing ID validation
934     // upon lookup. Instead, we keep space for the type ID 0 in our data structures. Since
935     // the construction of this type is guarded with a resource ID check, it will never be
936     // populated, and querying type ID 0 will always fail.
937     const int package_idx = get_package_id(attr_resid);
938     const int type_idx = get_type_id(attr_resid);
939     const int entry_idx = get_entry_id(attr_resid);
940 
941     if (last_package_idx != package_idx) {
942       std::unique_ptr<Package>& package = packages_[package_idx];
943       if (package == nullptr) {
944         package.reset(new Package());
945       }
946       last_package_idx = package_idx;
947       last_package = package.get();
948       last_type_idx = -1;
949     }
950 
951     if (last_type_idx != type_idx) {
952       util::unique_cptr<ThemeType>& type = last_package->types[type_idx];
953       if (type == nullptr) {
954         // Allocate enough memory to contain this entry_idx. Since we're iterating in reverse over
955         // a sorted list of attributes, this shouldn't be resized again during this method call.
956         type.reset(reinterpret_cast<ThemeType*>(
957             calloc(sizeof(ThemeType) + (entry_idx + 1) * sizeof(ThemeEntry), 1)));
958         type->entry_count = entry_idx + 1;
959       } else if (entry_idx >= type->entry_count) {
960         // Reallocate the memory to contain this entry_idx. Since we're iterating in reverse over
961         // a sorted list of attributes, this shouldn't be resized again during this method call.
962         const int new_count = entry_idx + 1;
963         type.reset(reinterpret_cast<ThemeType*>(
964             realloc(type.release(), sizeof(ThemeType) + (new_count * sizeof(ThemeEntry)))));
965 
966         // Clear out the newly allocated space (which isn't zeroed).
967         memset(type->entries + type->entry_count, 0,
968                (new_count - type->entry_count) * sizeof(ThemeEntry));
969         type->entry_count = new_count;
970       }
971       last_type_idx = type_idx;
972       last_type = type.get();
973     }
974 
975     ThemeEntry& entry = last_type->entries[entry_idx];
976     if (force || (entry.value.dataType == Res_value::TYPE_NULL &&
977                   entry.value.data != Res_value::DATA_NULL_EMPTY)) {
978       entry.cookie = bag_iter->cookie;
979       entry.type_spec_flags |= bag->type_spec_flags;
980       entry.value = bag_iter->value;
981     }
982   }
983   return true;
984 }
985 
GetAttribute(uint32_t resid,Res_value * out_value,uint32_t * out_flags) const986 ApkAssetsCookie Theme::GetAttribute(uint32_t resid, Res_value* out_value,
987                                     uint32_t* out_flags) const {
988   int cnt = 20;
989 
990   uint32_t type_spec_flags = 0u;
991 
992   do {
993     const int package_idx = get_package_id(resid);
994     const Package* package = packages_[package_idx].get();
995     if (package != nullptr) {
996       // The themes are constructed with a 1-based type ID, so no need to decrement here.
997       const int type_idx = get_type_id(resid);
998       const ThemeType* type = package->types[type_idx].get();
999       if (type != nullptr) {
1000         const int entry_idx = get_entry_id(resid);
1001         if (entry_idx < type->entry_count) {
1002           const ThemeEntry& entry = type->entries[entry_idx];
1003           type_spec_flags |= entry.type_spec_flags;
1004 
1005           if (entry.value.dataType == Res_value::TYPE_ATTRIBUTE) {
1006             if (cnt > 0) {
1007               cnt--;
1008               resid = entry.value.data;
1009               continue;
1010             }
1011             return kInvalidCookie;
1012           }
1013 
1014           // @null is different than @empty.
1015           if (entry.value.dataType == Res_value::TYPE_NULL &&
1016               entry.value.data != Res_value::DATA_NULL_EMPTY) {
1017             return kInvalidCookie;
1018           }
1019 
1020           *out_value = entry.value;
1021           *out_flags = type_spec_flags;
1022           return entry.cookie;
1023         }
1024       }
1025     }
1026     break;
1027   } while (true);
1028   return kInvalidCookie;
1029 }
1030 
ResolveAttributeReference(ApkAssetsCookie cookie,Res_value * in_out_value,ResTable_config * in_out_selected_config,uint32_t * in_out_type_spec_flags,uint32_t * out_last_ref) const1031 ApkAssetsCookie Theme::ResolveAttributeReference(ApkAssetsCookie cookie, Res_value* in_out_value,
1032                                                  ResTable_config* in_out_selected_config,
1033                                                  uint32_t* in_out_type_spec_flags,
1034                                                  uint32_t* out_last_ref) const {
1035   if (in_out_value->dataType == Res_value::TYPE_ATTRIBUTE) {
1036     uint32_t new_flags;
1037     cookie = GetAttribute(in_out_value->data, in_out_value, &new_flags);
1038     if (cookie == kInvalidCookie) {
1039       return kInvalidCookie;
1040     }
1041 
1042     if (in_out_type_spec_flags != nullptr) {
1043       *in_out_type_spec_flags |= new_flags;
1044     }
1045   }
1046   return asset_manager_->ResolveReference(cookie, in_out_value, in_out_selected_config,
1047                                           in_out_type_spec_flags, out_last_ref);
1048 }
1049 
Clear()1050 void Theme::Clear() {
1051   type_spec_flags_ = 0u;
1052   for (std::unique_ptr<Package>& package : packages_) {
1053     package.reset();
1054   }
1055 }
1056 
SetTo(const Theme & o)1057 bool Theme::SetTo(const Theme& o) {
1058   if (this == &o) {
1059     return true;
1060   }
1061 
1062   type_spec_flags_ = o.type_spec_flags_;
1063 
1064   const bool copy_only_system = asset_manager_ != o.asset_manager_;
1065 
1066   for (size_t p = 0; p < packages_.size(); p++) {
1067     const Package* package = o.packages_[p].get();
1068     if (package == nullptr || (copy_only_system && p != 0x01)) {
1069       // The other theme doesn't have this package, clear ours.
1070       packages_[p].reset();
1071       continue;
1072     }
1073 
1074     if (packages_[p] == nullptr) {
1075       // The other theme has this package, but we don't. Make one.
1076       packages_[p].reset(new Package());
1077     }
1078 
1079     for (size_t t = 0; t < package->types.size(); t++) {
1080       const ThemeType* type = package->types[t].get();
1081       if (type == nullptr) {
1082         // The other theme doesn't have this type, clear ours.
1083         packages_[p]->types[t].reset();
1084         continue;
1085       }
1086 
1087       // Create a new type and update it to theirs.
1088       const size_t type_alloc_size = sizeof(ThemeType) + (type->entry_count * sizeof(ThemeEntry));
1089       void* copied_data = malloc(type_alloc_size);
1090       memcpy(copied_data, type, type_alloc_size);
1091       packages_[p]->types[t].reset(reinterpret_cast<ThemeType*>(copied_data));
1092     }
1093   }
1094   return true;
1095 }
1096 
1097 }  // namespace android
1098