Merge remote-tracking branch 'lineageos/cm-13.0' into replicant-6.0

This commit is contained in:
Wolfgang Wiedmeyer 2017-09-08 18:45:52 +02:00
commit 0da489f4bf
3 changed files with 16 additions and 1 deletions

View File

@ -26,6 +26,7 @@
#include <binder/Parcel.h>
#include <binder/IInterface.h>
#include <gui/BufferQueueDefs.h>
#include <gui/IGraphicBufferProducer.h>
#include <gui/IProducerListener.h>
@ -170,8 +171,16 @@ public:
if (result != NO_ERROR) {
return result;
}
*slot = reply.readInt32();
result = reply.readInt32();
if (result == NO_ERROR &&
(*slot < 0 || *slot >= BufferQueueDefs::NUM_BUFFER_SLOTS)) {
ALOGE("attachBuffer returned invalid slot %d", *slot);
android_errorWriteLog(0x534e4554, "37478824");
return UNKNOWN_ERROR;
}
return result;
}

View File

@ -237,6 +237,12 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) {
return result;
}
if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
return FAILED_TRANSACTION;
}
Mutex::Autolock lock(mMutex);
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);

View File

@ -157,7 +157,7 @@ status_t Fence::unflatten(void const*& buffer, size_t& size, int const*& fds, si
return INVALID_OPERATION;
}
if (size < 1) {
if (size < getFlattenedSize()) {
return NO_MEMORY;
}