Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51f53db3 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Android (Google) Code Review
Browse files

Merge changes from topic "sensors_fuzzz" 

* changes:
  Remove some new memory leaks from SensorManager
  Check for malformed Sensor Flattenable
parents 45192525 91e97b88

libs/sensor/ISensorServer.cpp

+10 −2
Original line number Diff line number Diff line
@@ -67,7 +67,11 @@ public: 
        v.setCapacity(n);

        while (n) {

            n--;

            reply.read(s);

            if(reply.read(s) != OK) {

                ALOGE("Failed to read reply from getSensorList");

                v.clear();

                break;

            }

            v.add(s);

        }

        return v;
@@ -85,7 +89,11 @@ public: 
        v.setCapacity(n);

        while (n) {

            n--;

            reply.read(s);

            if(reply.read(s) != OK) {

                ALOGE("Failed to read reply from getDynamicSensorList");

                v.clear();

                break;

            }

            v.add(s);

        }

        return v;

libs/sensor/Sensor.cpp

+6 −0
Original line number Diff line number Diff line
@@ -628,7 +628,13 @@ bool Sensor::unflattenString8(void const*& buffer, size_t& size, String8& output 
        return false;

    }

    outputString8.setTo(static_cast<char const*>(buffer), len);



    if (size < FlattenableUtils::align<4>(len)) {

        ALOGE("Malformed Sensor String8 field. Should be in a 4-byte aligned buffer but is not.");

        return false;

    }

    FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len));



    return true;

}

libs/sensor/SensorManager.cpp

+5 −0
Original line number Diff line number Diff line
@@ -166,6 +166,11 @@ status_t SensorManager::assertStateLocked() { 


        mSensors = mSensorServer->getSensorList(mOpPackageName);

        size_t count = mSensors.size();

        if (count == 0) {

            ALOGE("Failed to get Sensor list");

            mSensorServer.clear();

            return UNKNOWN_ERROR;

        }

        mSensorList =

                static_cast<Sensor const**>(malloc(count * sizeof(Sensor*)));

        LOG_ALWAYS_FATAL_IF(mSensorList == nullptr, "mSensorList NULL");