Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cefa91bb authored Jan 16, 2017 by Peng Xu

[sensors] Add parameter check to poll()

Check maxCount parameter so that it will not allocate overly large
amount of memory if input parameter is bad.

Bug: 32953589
Test: build and pass vts
Change-Id: Ia19e0315ab1623b8b6580889c1e058a19e6c9670

parent 5567177a

sensors/1.0/ISensors.hal

+3 −1

Original line number	Diff line number	Diff line
		@@ -61,7 +61,9 @@ interface ISensors {
		* If there is no sensor event when this function is being called, block
		* until there are sensor events available.
		*
		* @param maxCount max number of samples can be returned.
		* @param maxCount max number of samples can be returned, must be > 0.
		* Actual number of events returned in data must be <= maxCount
		* and > 0.
		* @return result OK on success or BAD_VALUE if maxCount <= 0.
		* @return data vector of Event contains sensor events.
		* @return dynamicSensorsAdded vector of SensorInfo contains dynamic sensor

sensors/1.0/default/Sensors.cpp

+4 −3

Original line number	Diff line number	Diff line
		@@ -151,12 +151,13 @@ Return<void> Sensors::poll(int32_t maxCount, poll_cb _hidl_cb) {
		return Void();
		}

		std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[maxCount]);
		int bufferSize = maxCount <= kPollMaxBufferSize ? maxCount : kPollMaxBufferSize;

		std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[bufferSize]);

		int err = mSensorDevice->poll(
		reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
		data.get(),
		maxCount);
		data.get(), bufferSize);

		if (err < 0) {
		_hidl_cb(ResultFromStatus(err), out, dynamicSensorsAdded);

sensors/1.0/default/Sensors.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -27,6 +27,7 @@ namespace sensors {
		namespace V1_0 {
		namespace implementation {


		struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
		Sensors();

		@@ -60,6 +61,7 @@ struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
		configDirectReport_cb _hidl_cb) override;

		private:
		static constexpr int32_t kPollMaxBufferSize = 128;
		status_t mInitCheck;
		sensors_module_t *mSensorModule;
		sensors_poll_device_1_t *mSensorDevice;