Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f3b3169f authored by Ram Indani's avatar Ram Indani Committed by Automerger Merge Worker
Browse files

Merge "[VTS 2.3] Add length check before reading blob" into udc-dev am: a9d135cd am: 5314ce4c 

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/23438943



Change-Id: I783810fbdcdcf5ef83fd147f167d024483df57d4
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents de19c07e 5314ce4c

graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h

+1 −1
Original line number Diff line number Diff line
@@ -82,7 +82,7 @@ class ComposerCommandEngine : public V2_2::hal::ComposerCommandEngine { 


        std::vector<IComposerClient::PerFrameMetadataBlob> metadata;



        for (size_t i = 0; i < numBlobs; i++) {

        for (size_t i = 0; i < numBlobs && length >= 2; i++) {

            IComposerClient::PerFrameMetadataKey key =

                static_cast<IComposerClient::PerFrameMetadataKey>(readSigned());

            uint32_t blobSize = read();