Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ab92c16 authored by Brian Duddie's avatar Brian Duddie Committed by android-build-merger
Browse files

Add bounds check to sensors direct channel creation am: 0eb4624b am: 9f58afcc am: cfbef9f6

am: 3edc5ea2

Change-Id: I81464f8d79d2cf4857dd0d24a91127212d0c1fa7
parents 8ec1b406 3edc5ea2
Loading
Loading
Loading
Loading
+7 −1
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@
#include <cutils/properties.h>
#include <hardware/sensors.h>
#include <hardware_legacy/power.h>
#include <log/log.h>
#include <openssl/digest.h>
#include <openssl/hmac.h>
#include <openssl/rand.h>
@@ -1093,10 +1094,15 @@ sp<ISensorEventConnection> SensorService::createSensorDirectConnection(
    // check specific to memory type
    switch(type) {
        case SENSOR_DIRECT_MEM_TYPE_ASHMEM: { // channel backed by ashmem
            if (resource->numFds < 1) {
                ALOGE("Ashmem direct channel requires a memory region to be supplied");
                android_errorWriteLog(0x534e4554, "70986337");  // SafetyNet
                return nullptr;
            }
            int fd = resource->data[0];
            int size2 = ashmem_get_size_region(fd);
            // check size consistency
            if (size2 < static_cast<int>(size)) {
            if (size2 < static_cast<int64_t>(size)) {
                ALOGE("Ashmem direct channel size %" PRIu32 " greater than shared memory size %d",
                      size, size2);
                return nullptr;