Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit caee7cd3 authored by ramindani's avatar ramindani Committed by Ram Indani
Browse files

[VTS 2.3] Add length check before reading blob 

Adding a length check prevents the read() from
reading outside the bounds and prevents OOB crash.

Test: atest VtsHalGraphicsComposerV2_3TargetTest && atest VtsHalGraphicsComposerV2_4TargetTest
BUG: 252764300
Change-Id: I6231e340a925127f9c32ccb76768286f7292df58
Merged-In: I6231e340a925127f9c32ccb76768286f7292df58
parent a3f446f5

graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h

+1 −1
Original line number Diff line number Diff line
@@ -82,7 +82,7 @@ class ComposerCommandEngine : public V2_2::hal::ComposerCommandEngine { 


        std::vector<IComposerClient::PerFrameMetadataBlob> metadata;



        for (size_t i = 0; i < numBlobs; i++) {

        for (size_t i = 0; i < numBlobs && length >= 2; i++) {

            IComposerClient::PerFrameMetadataKey key =

                static_cast<IComposerClient::PerFrameMetadataKey>(readSigned());

            uint32_t blobSize = read();