Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ebc2e2eb authored by Melody Hsu's avatar Melody Hsu
Browse files

Validate position and matrix for txs 

Transactions would allow invalid values like -inf and inf to be
applied, leading to exceptions and test failures. Conduct validity
checks before the layer state is updated and abort for invalid values.

Bug: b/421893581
Test: SurfaceControlTest
Flag: EXEMPT, bug fix, error handling
Change-Id: Ib80265462a083737ec7a7efe5a2372e84832f092
parent 207f29c5

include/android/surface_control.h

+2 −0
Original line number Diff line number Diff line
@@ -496,6 +496,7 @@ void ASurfaceTransaction_setCrop(ASurfaceTransaction* _Nonnull transaction, 


/**

 * Specifies the position in the parent's space where the surface will be drawn.

 * Only permits finite values to be set.

 *

 * \param x The x position to render the surface.

 * \param y The y position to render the surface.
@@ -519,6 +520,7 @@ void ASurfaceTransaction_setBufferTransform(ASurfaceTransaction* _Nonnull transa 


/**

 * Sets an x and y scale of a surface with (0, 0) as the centerpoint of the scale.

 * Only permits finite values to be set.

 *

 * \param xScale The scale in the x direction. Must be greater than 0.

 * \param yScale The scale in the y direction. Must be greater than 0.

libs/gui/SurfaceComposerClient.cpp

+3 −0
Original line number Diff line number Diff line
@@ -1322,6 +1322,7 @@ SurfaceComposerClient::Transaction& SurfaceComposerClient::Transaction::setPosit 
        mStatus = BAD_INDEX;

        return *this;

    }

    LOG_ALWAYS_FATAL_IF(!isfinite(x) || !isfinite(y), "setPosition called with infinite values");

    s->what |= layer_state_t::ePositionChanged;

    s->x = x;

    s->y = y;
@@ -1462,6 +1463,8 @@ SurfaceComposerClient::Transaction& SurfaceComposerClient::Transaction::setMatri 
        mStatus = BAD_INDEX;

        return *this;

    }

    LOG_ALWAYS_FATAL_IF(!isfinite(dsdx) || !isfinite(dtdx) || !isfinite(dtdy) || !isfinite(dsdy),

                        "setMatrix called with infinite values");

    s->what |= layer_state_t::eMatrixChanged;

    layer_state_t::matrix22_t matrix;

    matrix.dsdx = dsdx;