summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorandroid-build-team Robot <android-build-team-robot@google.com>2017-06-08 18:25:43 +0000
committerandroid-build-team Robot <android-build-team-robot@google.com>2017-06-08 18:25:43 +0000
commit89b2934e69c2e7674df33b974c2746197eababb9 (patch)
tree82cb23d91d5d87e43adff5106953a13a2fd5d244
parent773ff4f9e121790b668183fb6850328c74157525 (diff)
parent2aa91b37c8f8691c6a77f87b0b2551d15dca2ad2 (diff)
downloadandroid-frameworks-native-android-6.0.1_r80.tar.gz
android-frameworks-native-android-6.0.1_r80.tar.xz
Merge cherrypicks of [2379347, 2379239, 2379364, 2379160, 2379220, 2379290, 2379348, 2379328, 2379329, 2379349, 2379350, 2379365, 2379401, 2379351, 2379330, 2379313, 2379382, 2379275, 2379331, 2379352, 2379292, 2379314, 2379315, 2379402, 2379421, 2379369, 2379255, 2379317, 2379404, 2379279, 2379334, 2379372, 2379335] into mnc-mr2-releaseandroid-6.0.1_r80
Change-Id: I5c3023638d63714982568078eb3f7d213dd890d6
-rw-r--r--libs/gui/IGraphicBufferProducer.cpp9
-rw-r--r--libs/gui/Surface.cpp6
-rw-r--r--libs/ui/Fence.cpp2
3 files changed, 16 insertions, 1 deletions
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index c3c6235..51eedab 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -26,6 +26,7 @@
#include <binder/Parcel.h>
#include <binder/IInterface.h>
+#include <gui/BufferQueueDefs.h>
#include <gui/IGraphicBufferProducer.h>
#include <gui/IProducerListener.h>
@@ -170,8 +171,16 @@ public:
if (result != NO_ERROR) {
return result;
}
+
*slot = reply.readInt32();
result = reply.readInt32();
+ if (result == NO_ERROR &&
+ (*slot < 0 || *slot >= BufferQueueDefs::NUM_BUFFER_SLOTS)) {
+ ALOGE("attachBuffer returned invalid slot %d", *slot);
+ android_errorWriteLog(0x534e4554, "37478824");
+ return UNKNOWN_ERROR;
+ }
+
return result;
}
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 4b76f98..22aa4ec 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -237,6 +237,12 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) {
return result;
}
+ if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+ ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+ android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+ return FAILED_TRANSACTION;
+ }
+
Mutex::Autolock lock(mMutex);
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);
diff --git a/libs/ui/Fence.cpp b/libs/ui/Fence.cpp
index bf24ffb..1b2f34d 100644
--- a/libs/ui/Fence.cpp
+++ b/libs/ui/Fence.cpp
@@ -157,7 +157,7 @@ status_t Fence::unflatten(void const*& buffer, size_t& size, int const*& fds, si
return INVALID_OPERATION;
}
- if (size < 1) {
+ if (size < getFlattenedSize()) {
return NO_MEMORY;
}