Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64de490b authored by Praveena Pachipulusu's avatar Praveena Pachipulusu Committed by Steve Kondik
Browse files

SurfaceFlinger: Add NULL check for buffer handling 

Add buffer handling NULL check in dequeueBuffer and
verify whether the output data from binder is not NULL
in queueBuffer and connect api's to avoid SF crash

CRs-Fixed: 573088
CRs-Fixed: 572315

Change-Id: I41cebbc0cbcbbb0fd5ecb38db7ec7b0c91cdffe9
parent 6ec03528

libs/gui/IGraphicBufferProducer.cpp

+12 −2
Original line number Diff line number Diff line
@@ -113,7 +113,12 @@ public: 
        if (result != NO_ERROR) {

            return result;

        }

        memcpy(output, reply.readInplace(sizeof(*output)), sizeof(*output));

        const void *out_data =reply.readInplace(sizeof(*output));

        if(out_data != NULL) {

            memcpy(output, out_data, sizeof(*output));

        } else {

            return BAD_VALUE;

        }

        result = reply.readInt32();

        return result;

    }
@@ -150,7 +155,12 @@ public: 
        if (result != NO_ERROR) {

            return result;

        }

        memcpy(output, reply.readInplace(sizeof(*output)), sizeof(*output));

        const void *out_data =reply.readInplace(sizeof(*output));

        if(out_data != NULL) {

            memcpy(output, out_data, sizeof(*output));

        } else {

            return BAD_VALUE;

        }

        result = reply.readInt32();

        return result;

    }

libs/gui/Surface.cpp

+3 −0
Original line number Diff line number Diff line
@@ -216,6 +216,9 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) { 
        if (result != NO_ERROR) {

            ALOGE("dequeueBuffer: IGraphicBufferProducer::requestBuffer failed: %d", result);

            return result;

        } else if (gbuf == 0) {

            ALOGE("dequeueBuffer: Buffer is null return");

            return INVALID_OPERATION;

        }

    }