Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6e3cf4a authored by John Reck's avatar John Reck
Browse files

Fix array out of bounds access in JankTracker 

Fixes: 27873879

If frametime > max janktracker would accidentally
double-increment totalFrameCount due to overflowing
the end of frameCounts

Change-Id: Iebfd1349b7014ade807f42d9c196139274a96684
parent 5bee0596

libs/hwui/JankTracker.cpp

+1 −1
Original line number Diff line number Diff line
@@ -244,7 +244,7 @@ void JankTracker::addFrame(const FrameInfo& frame) { 
    int64_t totalDuration =

            frame[FrameInfoIndex::FrameCompleted] - frame[FrameInfoIndex::IntendedVsync];

    uint32_t framebucket = frameCountIndexForFrameTime(

            totalDuration, mData->frameCounts.size());

            totalDuration, mData->frameCounts.size() - 1);

    // Keep the fast path as fast as possible.

    if (CC_LIKELY(totalDuration < mFrameInterval)) {

        mData->frameCounts[framebucket]++;