Commit c94fc45b authored Sep 22, 2015 by Dan Austin

Eliminate benign overflow condition triggered upon loop termination in Input.cpp

In readFromParcel, a while loop is terminated when sampleCount = 0. The
decrement operation that was here would decrease sampleCount, an unsigned value,
below 0, triggering an unsigned integer overflow. The while loop was refactored
to eliminate this condition.

Bug: 24171356
Change-Id: I7669f54a41d11548b33e322b025431c6f6038952

parent 251c8b3f

libs/input/Input.cpp

+2 −1

Original line number	Diff line number	Diff line
		@@ -452,7 +452,8 @@ status_t MotionEvent::readFromParcel(Parcel* parcel) {
		properties.toolType = parcel->readInt32();
		}

		while (sampleCount-- > 0) {
		while (sampleCount > 0) {
		sampleCount--;
		mSampleEventTimes.push(parcel->readInt64());
		for (size_t i = 0; i < pointerCount; i++) {
		mSamplePointerCoords.push();