Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ac74742 authored by Flanker's avatar Flanker Committed by The Android Automerger
Browse files

add number constraint for samples per MotionEvent 



Bug:23905002

Signed-off-by: default avatarAdam Lesinski <adamlesinski@google.com>

(cherry picked from commit 552a8a5d)

Change-Id: I9b7ea859889b7697bee4165a2746602212120543
parent 67a7582b

include/input/Input.h

+5 −0
Original line number Original line Diff line number Diff line
@@ -110,6 +110,11 @@ enum { 
 */

 */

#define MAX_POINTERS 16

#define MAX_POINTERS 16





/*

 * Maximum number of samples supported per motion event.

 */

#define MAX_SAMPLES UINT16_MAX



/*

/*

 * Maximum pointer id value supported in a motion event.

 * Maximum pointer id value supported in a motion event.

 * Smallest pointer id is 0.

 * Smallest pointer id is 0.

libs/input/Input.cpp

+2 −1
Original line number Original line Diff line number Diff line
@@ -421,7 +421,8 @@ void MotionEvent::transform(const float matrix[9]) { 
status_t MotionEvent::readFromParcel(Parcel* parcel) {

status_t MotionEvent::readFromParcel(Parcel* parcel) {

    size_t pointerCount = parcel->readInt32();

    size_t pointerCount = parcel->readInt32();

    size_t sampleCount = parcel->readInt32();

    size_t sampleCount = parcel->readInt32();

    if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) {

    if (pointerCount == 0 || pointerCount > MAX_POINTERS ||

            sampleCount == 0 || sampleCount > MAX_SAMPLES) {

        return BAD_VALUE;

        return BAD_VALUE;

    }

    }