Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c1840101 authored by radhakrishna's avatar radhakrishna Committed by Steve Kondik
Browse files

sf: Restrict GPU tile render feature to MAX_LAYER_COUNT 

- When number of layers exceed MAX_LAYER_COUNT, the compType
  array that is used in tile render feature overflows which
  leads to memory corruption causing random crash.
- To avoid this possible memory corruption, limit GPU tile render
  feature to MAX_LAYER_COUNT.

Change-Id: I42a4245345aa689d0254843686d52eb8c6724955
CRs-Fixed: 863707
parent 0fe18ff0

services/surfaceflinger/DisplayHardware/HWComposer.cpp

+2 −1
Original line number Diff line number Diff line
@@ -774,7 +774,8 @@ status_t HWComposer::prepare() { 
                    }

#ifdef QCOM_BSP

                    //GPUTILERECT

                    if(l.compositionType != HWC_FRAMEBUFFER_TARGET) {

                    if(l.compositionType != HWC_FRAMEBUFFER_TARGET &&

                            disp.list->numHwLayers < MAX_LAYER_COUNT) {

                        current_comp_map[i].compType[j] = l.compositionType;

                    }

#endif

services/surfaceflinger/DisplayHardware/HWComposer.h

+2 −2
Original line number Diff line number Diff line
@@ -418,14 +418,14 @@ private: 
            if(this != &rhs) {

                reset();

                count = rhs.count;

                for(int32_t i=0; i<count; i++) {

                for(int32_t i=0; i<count && count<MAX_LAYER_COUNT; i++) {

                    compType[i] = rhs.compType[i];

                }

            }

            return *this;

        }

        bool operator== (CompMap &rhs) {

            if( count != rhs.count)

            if( count != rhs.count || count>MAX_LAYER_COUNT )

                return false;

            for(int32_t i=0; i<count; i++) {

                if(compType[i] != rhs.compType[i])