Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 138d751a authored by Robert Carr's avatar Robert Carr Committed by Automerger Merge Worker
Browse files

DO NOT MERGE: fillInputInfo: Guard against integer overflow. am: 66909092 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/12690800

Change-Id: I96c0b8fc1df2479c4cd5a6f1d96a7bfef3410ddb
parents fe784f3f 66909092

services/surfaceflinger/Layer.cpp

+9 −1
Original line number Diff line number Diff line
@@ -2410,7 +2410,15 @@ InputWindowInfo Layer::fillInputInfo() { 
    xSurfaceInset = (xSurfaceInset >= 0) ? std::min(xSurfaceInset, layerBounds.getWidth() / 2) : 0;

    ySurfaceInset = (ySurfaceInset >= 0) ? std::min(ySurfaceInset, layerBounds.getHeight() / 2) : 0;



    layerBounds.inset(xSurfaceInset, ySurfaceInset, xSurfaceInset, ySurfaceInset);

    // inset while protecting from overflow TODO(b/161235021): What is going wrong

    // in the overflow scenario?

    {

    int32_t tmp;

    if (!__builtin_add_overflow(layerBounds.left, xSurfaceInset, &tmp)) layerBounds.left = tmp;

    if (!__builtin_sub_overflow(layerBounds.right, xSurfaceInset, &tmp)) layerBounds.right = tmp;

    if (!__builtin_add_overflow(layerBounds.top, ySurfaceInset, &tmp)) layerBounds.top = tmp;

    if (!__builtin_sub_overflow(layerBounds.bottom, ySurfaceInset, &tmp)) layerBounds.bottom = tmp;

    }



    // Input coordinate should match the layer bounds.

    info.frameLeft = layerBounds.left;