Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84cac20d authored by Romain Guy's avatar Romain Guy
Browse files

Add null checks for *Buffer params 

This change prevents crashes in native layers and throws an exception
instead.

Bug: 25695785
Test: CtsGraphicsTestCases
Change-Id: I0b4115e001099f579f53e47fa5cb9c851c6dabdb
parent e9bf7c84

core/jni/android_opengl_GLES10.cpp

+213 −1
Original line number Diff line number Diff line
@@ -600,6 +600,9 @@ android_glColorMask__ZZZZ 
static void

android_glColorPointerBounds__IIILjava_nio_Buffer_2I

  (JNIEnv *_env, jobject _this, jint size, jint type, jint stride, jobject pointer_buf, jint remaining) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -618,17 +621,29 @@ android_glColorPointerBounds__IIILjava_nio_Buffer_2I 
        (GLvoid *)pointer,

        (GLsizei)remaining

    );

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glCompressedTexImage2D ( GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLint border, GLsizei imageSize, const GLvoid *data ) */

static void

android_glCompressedTexImage2D__IIIIIIILjava_nio_Buffer_2

  (JNIEnv *_env, jobject _this, jint target, jint level, jint internalformat, jint width, jint height, jint border, jint imageSize, jobject data_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLvoid *data = (GLvoid *) 0;



    if (!data_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "data == null";

        goto exit;

    }

    data = (GLvoid *)getPointer(_env, data_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (data == NULL) {

        char * _dataBase = (char *)_env->GetPrimitiveArrayCritical(_array, (jboolean *) 0);
@@ -644,20 +659,34 @@ android_glCompressedTexImage2D__IIIIIIILjava_nio_Buffer_2 
        (GLsizei)imageSize,

        (GLvoid *)data

    );



exit:

    if (_array) {

        releasePointer(_env, _array, data, JNI_FALSE);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glCompressedTexSubImage2D ( GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const GLvoid *data ) */

static void

android_glCompressedTexSubImage2D__IIIIIIIILjava_nio_Buffer_2

  (JNIEnv *_env, jobject _this, jint target, jint level, jint xoffset, jint yoffset, jint width, jint height, jint format, jint imageSize, jobject data_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLvoid *data = (GLvoid *) 0;



    if (!data_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "data == null";

        goto exit;

    }

    data = (GLvoid *)getPointer(_env, data_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (data == NULL) {

        char * _dataBase = (char *)_env->GetPrimitiveArrayCritical(_array, (jboolean *) 0);
@@ -674,9 +703,14 @@ android_glCompressedTexSubImage2D__IIIIIIIILjava_nio_Buffer_2 
        (GLsizei)imageSize,

        (GLvoid *)data

    );



exit:

    if (_array) {

        releasePointer(_env, _array, data, JNI_FALSE);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glCopyTexImage2D ( GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width, GLsizei height, GLint border ) */
@@ -781,6 +815,12 @@ android_glDeleteTextures__ILjava_nio_IntBuffer_2 
    jint _remaining;

    GLuint *textures = (GLuint *) 0;



    if (!textures_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "textures == null";

        goto exit;

    }

    textures = (GLuint *)getPointer(_env, textures_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (_remaining < n) {

        _exception = 1;
@@ -885,6 +925,12 @@ android_glDrawElements__IIILjava_nio_Buffer_2 
    jint _remaining;

    GLvoid *indices = (GLvoid *) 0;



    if (!indices_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "indices == null";

        goto exit;

    }

    indices = (GLvoid *)getPointer(_env, indices_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (_remaining < count) {

        _exception = 1;
@@ -1026,6 +1072,12 @@ android_glFogfv__ILjava_nio_FloatBuffer_2 
    jint _remaining;

    GLfloat *params = (GLfloat *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfloat *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1144,6 +1196,12 @@ android_glFogxv__ILjava_nio_IntBuffer_2 
    jint _remaining;

    GLfixed *params = (GLfixed *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfixed *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1278,6 +1336,12 @@ android_glGenTextures__ILjava_nio_IntBuffer_2 
    jint _remaining;

    GLuint *textures = (GLuint *) 0;



    if (!textures_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "textures == null";

        goto exit;

    }

    textures = (GLuint *)getPointer(_env, textures_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (_remaining < n) {

        _exception = 1;
@@ -1424,6 +1488,12 @@ android_glLightModelfv__ILjava_nio_FloatBuffer_2 
    jint _remaining;

    GLfloat *params = (GLfloat *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfloat *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1542,6 +1612,12 @@ android_glLightModelxv__ILjava_nio_IntBuffer_2 
    jint _remaining;

    GLfixed *params = (GLfixed *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfixed *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1676,6 +1752,12 @@ android_glLightfv__IILjava_nio_FloatBuffer_2 
    jint _remaining;

    GLfloat *params = (GLfloat *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfloat *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1825,6 +1907,12 @@ android_glLightxv__IILjava_nio_IntBuffer_2 
    jint _remaining;

    GLfixed *params = (GLfixed *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfixed *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -1947,11 +2035,20 @@ exit: 
static void

android_glLoadMatrixf__Ljava_nio_FloatBuffer_2

  (JNIEnv *_env, jobject _this, jobject m_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jfloatArray _array = (jfloatArray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLfloat *m = (GLfloat *) 0;



    if (!m_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "m == null";

        goto exit;

    }

    m = (GLfloat *)getPointer(_env, m_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (m == NULL) {

        char * _mBase = (char *)_env->GetFloatArrayElements(_array, (jboolean *) 0);
@@ -1960,9 +2057,14 @@ android_glLoadMatrixf__Ljava_nio_FloatBuffer_2 
    glLoadMatrixf(

        (GLfloat *)m

    );



exit:

    if (_array) {

        _env->ReleaseFloatArrayElements(_array, (jfloat*)m, JNI_ABORT);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glLoadMatrixx ( const GLfixed *m ) */
@@ -2011,11 +2113,20 @@ exit: 
static void

android_glLoadMatrixx__Ljava_nio_IntBuffer_2

  (JNIEnv *_env, jobject _this, jobject m_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jintArray _array = (jintArray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLfixed *m = (GLfixed *) 0;



    if (!m_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "m == null";

        goto exit;

    }

    m = (GLfixed *)getPointer(_env, m_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (m == NULL) {

        char * _mBase = (char *)_env->GetIntArrayElements(_array, (jboolean *) 0);
@@ -2024,9 +2135,14 @@ android_glLoadMatrixx__Ljava_nio_IntBuffer_2 
    glLoadMatrixx(

        (GLfixed *)m

    );



exit:

    if (_array) {

        _env->ReleaseIntArrayElements(_array, (jint*)m, JNI_ABORT);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glLogicOp ( GLenum opcode ) */
@@ -2134,6 +2250,12 @@ android_glMaterialfv__IILjava_nio_FloatBuffer_2 
    jint _remaining;

    GLfloat *params = (GLfloat *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfloat *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -2279,6 +2401,12 @@ android_glMaterialxv__IILjava_nio_IntBuffer_2 
    jint _remaining;

    GLfixed *params = (GLfixed *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfixed *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -2383,11 +2511,20 @@ exit: 
static void

android_glMultMatrixf__Ljava_nio_FloatBuffer_2

  (JNIEnv *_env, jobject _this, jobject m_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jfloatArray _array = (jfloatArray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLfloat *m = (GLfloat *) 0;



    if (!m_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "m == null";

        goto exit;

    }

    m = (GLfloat *)getPointer(_env, m_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (m == NULL) {

        char * _mBase = (char *)_env->GetFloatArrayElements(_array, (jboolean *) 0);
@@ -2396,9 +2533,14 @@ android_glMultMatrixf__Ljava_nio_FloatBuffer_2 
    glMultMatrixf(

        (GLfloat *)m

    );



exit:

    if (_array) {

        _env->ReleaseFloatArrayElements(_array, (jfloat*)m, JNI_ABORT);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glMultMatrixx ( const GLfixed *m ) */
@@ -2447,11 +2589,20 @@ exit: 
static void

android_glMultMatrixx__Ljava_nio_IntBuffer_2

  (JNIEnv *_env, jobject _this, jobject m_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jintArray _array = (jintArray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLfixed *m = (GLfixed *) 0;



    if (!m_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "m == null";

        goto exit;

    }

    m = (GLfixed *)getPointer(_env, m_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (m == NULL) {

        char * _mBase = (char *)_env->GetIntArrayElements(_array, (jboolean *) 0);
@@ -2460,9 +2611,14 @@ android_glMultMatrixx__Ljava_nio_IntBuffer_2 
    glMultMatrixx(

        (GLfixed *)m

    );



exit:

    if (_array) {

        _env->ReleaseIntArrayElements(_array, (jint*)m, JNI_ABORT);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glMultiTexCoord4f ( GLenum target, GLfloat s, GLfloat t, GLfloat r, GLfloat q ) */
@@ -2517,6 +2673,9 @@ android_glNormal3x__III 
static void

android_glNormalPointerBounds__IILjava_nio_Buffer_2I

  (JNIEnv *_env, jobject _this, jint type, jint stride, jobject pointer_buf, jint remaining) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -2534,6 +2693,9 @@ android_glNormalPointerBounds__IILjava_nio_Buffer_2I 
        (GLvoid *)pointer,

        (GLsizei)remaining

    );

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glOrthof ( GLfloat left, GLfloat right, GLfloat bottom, GLfloat top, GLfloat zNear, GLfloat zFar ) */
@@ -2630,11 +2792,20 @@ android_glPushMatrix__ 
static void

android_glReadPixels__IIIIIILjava_nio_Buffer_2

  (JNIEnv *_env, jobject _this, jint x, jint y, jint width, jint height, jint format, jint type, jobject pixels_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;

    GLvoid *pixels = (GLvoid *) 0;



    if (!pixels_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "pixels == null";

        goto exit;

    }

    pixels = (GLvoid *)getPointer(_env, pixels_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    if (pixels == NULL) {

        char * _pixelsBase = (char *)_env->GetPrimitiveArrayCritical(_array, (jboolean *) 0);
@@ -2649,8 +2820,13 @@ android_glReadPixels__IIIIIILjava_nio_Buffer_2 
        (GLenum)type,

        (GLvoid *)pixels

    );



exit:

    if (_array) {

        releasePointer(_env, _array, pixels, JNI_TRUE);

        releasePointer(_env, _array, pixels, _exception ? JNI_FALSE : JNI_TRUE);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}
@@ -2776,6 +2952,9 @@ android_glStencilOp__III 
static void

android_glTexCoordPointerBounds__IIILjava_nio_Buffer_2I

  (JNIEnv *_env, jobject _this, jint size, jint type, jint stride, jobject pointer_buf, jint remaining) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -2794,6 +2973,9 @@ android_glTexCoordPointerBounds__IIILjava_nio_Buffer_2I 
        (GLvoid *)pointer,

        (GLsizei)remaining

    );

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glTexEnvf ( GLenum target, GLenum pname, GLfloat param ) */
@@ -2880,6 +3062,12 @@ android_glTexEnvfv__IILjava_nio_FloatBuffer_2 
    jint _remaining;

    GLfloat *params = (GLfloat *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfloat *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -3001,6 +3189,12 @@ android_glTexEnvxv__IILjava_nio_IntBuffer_2 
    jint _remaining;

    GLfixed *params = (GLfixed *) 0;



    if (!params_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "params == null";

        goto exit;

    }

    params = (GLfixed *)getPointer(_env, params_buf, (jarray*)&_array, &_remaining, &_bufferOffset);

    int _needed;

    switch (pname) {
@@ -3042,6 +3236,9 @@ exit: 
static void

android_glTexImage2D__IIIIIIIILjava_nio_Buffer_2

  (JNIEnv *_env, jobject _this, jint target, jint level, jint internalformat, jint width, jint height, jint border, jint format, jint type, jobject pixels_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -3068,6 +3265,9 @@ android_glTexImage2D__IIIIIIIILjava_nio_Buffer_2 
    if (_array) {

        releasePointer(_env, _array, pixels, JNI_FALSE);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glTexParameterf ( GLenum target, GLenum pname, GLfloat param ) */
@@ -3096,6 +3296,9 @@ android_glTexParameterx__III 
static void

android_glTexSubImage2D__IIIIIIIILjava_nio_Buffer_2

  (JNIEnv *_env, jobject _this, jint target, jint level, jint xoffset, jint yoffset, jint width, jint height, jint format, jint type, jobject pixels_buf) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -3122,6 +3325,9 @@ android_glTexSubImage2D__IIIIIIIILjava_nio_Buffer_2 
    if (_array) {

        releasePointer(_env, _array, pixels, JNI_FALSE);

    }

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glTranslatef ( GLfloat x, GLfloat y, GLfloat z ) */
@@ -3150,6 +3356,9 @@ android_glTranslatex__III 
static void

android_glVertexPointerBounds__IIILjava_nio_Buffer_2I

  (JNIEnv *_env, jobject _this, jint size, jint type, jint stride, jobject pointer_buf, jint remaining) {

    jint _exception = 0;

    const char * _exceptionType = NULL;

    const char * _exceptionMessage = NULL;

    jarray _array = (jarray) 0;

    jint _bufferOffset = (jint) 0;

    jint _remaining;
@@ -3168,6 +3377,9 @@ android_glVertexPointerBounds__IIILjava_nio_Buffer_2I 
        (GLvoid *)pointer,

        (GLsizei)remaining

    );

    if (_exception) {

        jniThrowException(_env, _exceptionType, _exceptionMessage);

    }

}



/* void glViewport ( GLint x, GLint y, GLsizei width, GLsizei height ) */

core/jni/android_opengl_GLES10Ext.cpp

+12 −0
Original line number Diff line number Diff line
@@ -540,6 +540,12 @@ android_glQueryMatrixxOES__Ljava_nio_IntBuffer_2Ljava_nio_IntBuffer_2 
    jint _exponentRemaining;

    GLint *exponent = (GLint *) 0;



    if (!mantissa_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "mantissa == null";

        goto exit;

    }

    mantissa = (GLfixed *)getPointer(_env, mantissa_buf, (jarray*)&_mantissaArray, &_mantissaRemaining, &_mantissaBufferOffset);

    if (_mantissaRemaining < 16) {

        _exception = 1;
@@ -547,6 +553,12 @@ android_glQueryMatrixxOES__Ljava_nio_IntBuffer_2Ljava_nio_IntBuffer_2 
        _exceptionMessage = "remaining() < 16 < needed";

        goto exit;

    }

    if (!exponent_buf) {

        _exception = 1;

        _exceptionType = "java/lang/IllegalArgumentException";

        _exceptionMessage = "exponent == null";

        goto exit;

    }

    exponent = (GLint *)getPointer(_env, exponent_buf, (jarray*)&_exponentArray, &_exponentRemaining, &_exponentBufferOffset);

    if (_exponentRemaining < 16) {

        _exception = 1;

core/jni/android_opengl_GLES11.cpp

+169 −1

File changed.

Preview size limit exceeded, changes collapsed.

core/jni/android_opengl_GLES11Ext.cpp

+430 −10

File changed.

Preview size limit exceeded, changes collapsed.

core/jni/android_opengl_GLES20.cpp

+334 −2

File changed.

Preview size limit exceeded, changes collapsed.