Loading include/input/Input.h +5 −0 Original line number Diff line number Diff line Loading @@ -110,6 +110,11 @@ enum { */ #define MAX_POINTERS 16 /* * Maximum number of samples supported per motion event. */ #define MAX_SAMPLES UINT16_MAX /* * Maximum pointer id value supported in a motion event. * Smallest pointer id is 0. Loading libs/input/Input.cpp +2 −1 Original line number Diff line number Diff line Loading @@ -421,7 +421,8 @@ void MotionEvent::transform(const float matrix[9]) { status_t MotionEvent::readFromParcel(Parcel* parcel) { size_t pointerCount = parcel->readInt32(); size_t sampleCount = parcel->readInt32(); if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) { if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0 || sampleCount > MAX_SAMPLES) { return BAD_VALUE; } Loading Loading
include/input/Input.h +5 −0 Original line number Diff line number Diff line Loading @@ -110,6 +110,11 @@ enum { */ #define MAX_POINTERS 16 /* * Maximum number of samples supported per motion event. */ #define MAX_SAMPLES UINT16_MAX /* * Maximum pointer id value supported in a motion event. * Smallest pointer id is 0. Loading
libs/input/Input.cpp +2 −1 Original line number Diff line number Diff line Loading @@ -421,7 +421,8 @@ void MotionEvent::transform(const float matrix[9]) { status_t MotionEvent::readFromParcel(Parcel* parcel) { size_t pointerCount = parcel->readInt32(); size_t sampleCount = parcel->readInt32(); if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) { if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0 || sampleCount > MAX_SAMPLES) { return BAD_VALUE; } Loading