Merge "[VTS 2.3] Add length check before reading blob" into udc-dev (a9d135cd) · Commits · e / os / android_hardware_interfaces

graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -82,7 +82,7 @@ class ComposerCommandEngine : public V2_2::hal::ComposerCommandEngine {

		std::vector<IComposerClient::PerFrameMetadataBlob> metadata;

		for (size_t i = 0; i < numBlobs; i++) {
		for (size_t i = 0; i < numBlobs && length >= 2; i++) {
		IComposerClient::PerFrameMetadataKey key =
		static_cast<IComposerClient::PerFrameMetadataKey>(readSigned());
		uint32_t blobSize = read();