Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f61bdcd authored by Siarhei Vishniakou's avatar Siarhei Vishniakou
Browse files

Stricter validation of motion events in dispatcher 

We are already validating incoming motion events, but for the events
received from the bottom layers, currently there's no crash.

Add a crash to ensure that the data that the dispatcher is getting is
good. Ideally, this would be done directly in the constructor for
NotifyMotionArgs, but that could be a separate refactor after we convert
pointerProperties and PointerCoords to std::vector.

Bug: 211379801
Test: m inputflinger_tests && $ANDROID_HOST_OUT/nativetest64/inputflinger_tests/inputflinger_tests
Change-Id: Id089db27245827de7c8f83b57dbf38adf820b5f8
parent 5cee1e36

services/inputflinger/dispatcher/InputDispatcher.cpp

+10 −9
Original line number Diff line number Diff line
@@ -148,21 +148,23 @@ bool validateKeyEvent(int32_t action) { 
}



bool isValidMotionAction(int32_t action, int32_t actionButton, int32_t pointerCount) {

    switch (action & AMOTION_EVENT_ACTION_MASK) {

    switch (MotionEvent::getActionMasked(action)) {

        case AMOTION_EVENT_ACTION_DOWN:

        case AMOTION_EVENT_ACTION_UP:

        case AMOTION_EVENT_ACTION_CANCEL:

            return pointerCount == 1;

        case AMOTION_EVENT_ACTION_MOVE:

        case AMOTION_EVENT_ACTION_OUTSIDE:

        case AMOTION_EVENT_ACTION_HOVER_ENTER:

        case AMOTION_EVENT_ACTION_HOVER_MOVE:

        case AMOTION_EVENT_ACTION_HOVER_EXIT:

            return pointerCount >= 1;

        case AMOTION_EVENT_ACTION_CANCEL:

        case AMOTION_EVENT_ACTION_OUTSIDE:

        case AMOTION_EVENT_ACTION_SCROLL:

            return true;

        case AMOTION_EVENT_ACTION_POINTER_DOWN:

        case AMOTION_EVENT_ACTION_POINTER_UP: {

            int32_t index = getMotionEventActionPointerIndex(action);

            return index >= 0 && index < pointerCount;

            const int32_t index = MotionEvent::getActionIndex(action);

            return index >= 0 && index < pointerCount && pointerCount > 1;

        }

        case AMOTION_EVENT_ACTION_BUTTON_PRESS:

        case AMOTION_EVENT_ACTION_BUTTON_RELEASE:
@@ -4056,10 +4058,9 @@ void InputDispatcher::notifyMotion(const NotifyMotionArgs* args) { 
                  args->pointerCoords[i].getAxisValue(AMOTION_EVENT_AXIS_ORIENTATION));

        }

    }

    if (!validateMotionEvent(args->action, args->actionButton, args->pointerCount,

                             args->pointerProperties)) {

        return;

    }

    LOG_ALWAYS_FATAL_IF(!validateMotionEvent(args->action, args->actionButton, args->pointerCount,

                                             args->pointerProperties),

                        "Invalid event: %s", args->dump().c_str());



    uint32_t policyFlags = args->policyFlags;

    policyFlags |= POLICY_FLAG_TRUSTED;