Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd149a6d authored by Fabien Sanglard's avatar Fabien Sanglard Committed by Dang Duy Son
Browse files

Fix security vulnerability 

AOSP-Change-Id: I4c9ea3a3177131fa29d2561da71ef18bec3af108
Test: angler, marlin
Bug: 32628763

CVE-2017-0546

Change-Id: I3e87518163540a9fce1d4fc3751ed558d4854140
(cherry picked from commit 45b20251)
(cherry picked from commit e34afe0a)
parent 91a4e5ad

services/surfaceflinger/SurfaceFlinger.cpp

+1 −2
Original line number Original line Diff line number Diff line
@@ -2299,8 +2299,7 @@ void SurfaceFlinger::setTransactionState( 
        if (s.client != NULL) {

        if (s.client != NULL) {

            sp<IBinder> binder = s.client->asBinder();

            sp<IBinder> binder = s.client->asBinder();

            if (binder != NULL) {

            if (binder != NULL) {

                String16 desc(binder->getInterfaceDescriptor());

                if (binder->queryLocalInterface(ISurfaceComposerClient::descriptor) != NULL) {

                if (desc == ISurfaceComposerClient::descriptor) {

                    sp<Client> client( static_cast<Client *>(s.client.get()) );

                    sp<Client> client( static_cast<Client *>(s.client.get()) );

                    transactionFlags |= setClientStateLocked(client, s.state);

                    transactionFlags |= setClientStateLocked(client, s.state);

                }

                }