Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae33effd authored by Michael Lentine's avatar Michael Lentine Committed by Dan Stoza
Browse files

Fix crash when user provides large values in the Parcel. 

Bug: 18102648
Change-Id: Ie6a24718e586a34424238363de80f9545951514f
(cherry-picked from commit 8afa1c4a)
parent 09b9193d

libs/gui/ISurfaceComposer.cpp

+12 −2
Original line number Diff line number Diff line
@@ -312,19 +312,29 @@ status_t BnSurfaceComposer::onTransact( 
        case SET_TRANSACTION_STATE: {

            CHECK_INTERFACE(ISurfaceComposer, data, reply);

            size_t count = data.readInt32();

            if (count > data.dataSize()) {

                return BAD_VALUE;

            }

            ComposerState s;

            Vector<ComposerState> state;

            state.setCapacity(count);

            for (size_t i=0 ; i<count ; i++) {

                s.read(data);

                if (s.read(data) == BAD_VALUE) {

                    return BAD_VALUE;

                }

                state.add(s);

            }

            count = data.readInt32();

            if (count > data.dataSize()) {

                return BAD_VALUE;

            }

            DisplayState d;

            Vector<DisplayState> displays;

            displays.setCapacity(count);

            for (size_t i=0 ; i<count ; i++) {

                d.read(data);

                if (d.read(data) == BAD_VALUE) {

                    return BAD_VALUE;

                }

                displays.add(d);

            }

            uint32_t flags = data.readInt32();

libs/gui/LayerState.cpp

+6 −2
Original line number Diff line number Diff line
@@ -55,8 +55,12 @@ status_t layer_state_t::read(const Parcel& input) 
    alpha = input.readFloat();

    flags = input.readInt32();

    mask = input.readInt32();

    matrix = *reinterpret_cast<layer_state_t::matrix22_t const *>(

            input.readInplace(sizeof(layer_state_t::matrix22_t)));

    const void* matrix_data = input.readInplace(sizeof(layer_state_t::matrix22_t));

    if (matrix_data) {

        matrix = *reinterpret_cast<layer_state_t::matrix22_t const *>(matrix_data);

    } else {

        return BAD_VALUE;

    }

    input.read(crop);

    input.read(transparentRegion);

    return NO_ERROR;