ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'lineageos/cm-13.0' into replicant-6.0

Browse Source
This commit is contained in:
Wolfgang Wiedmeyer 2017-09-08 18:45:52 +02:00
commit 0da489f4bf
3 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libs/gui/IGraphicBufferProducer.cpp
View File

@ -26,6 +26,7 @@
#include <binder/Parcel.h> #include <binder/Parcel.h>
#include <binder/IInterface.h> #include <binder/IInterface.h>
#include <gui/BufferQueueDefs.h>
#include <gui/IGraphicBufferProducer.h> #include <gui/IGraphicBufferProducer.h>
#include <gui/IProducerListener.h> #include <gui/IProducerListener.h>
@ -170,8 +171,16 @@ public:
if (result != NO_ERROR) { if (result != NO_ERROR) {
return result; return result;
} }
*slot = reply.readInt32(); *slot = reply.readInt32();
result = reply.readInt32(); result = reply.readInt32();
if (result == NO_ERROR &&
(*slot < 0 || *slot >= BufferQueueDefs::NUM_BUFFER_SLOTS)) {
ALOGE("attachBuffer returned invalid slot %d", *slot);
android_errorWriteLog(0x534e4554, "37478824");
return UNKNOWN_ERROR;
}
return result; return result;
} }

6
libs/gui/Surface.cpp
View File

@ -237,6 +237,12 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) {
return result; return result;
} }
if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
return FAILED_TRANSACTION;
}
Mutex::Autolock lock(mMutex); Mutex::Autolock lock(mMutex);
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer); sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);

2
libs/ui/Fence.cpp
View File

@ -157,7 +157,7 @@ status_t Fence::unflatten(void const*& buffer, size_t& size, int const*& fds, si
return INVALID_OPERATION; return INVALID_OPERATION;
} }
if (size < 1) { if (size < getFlattenedSize()) {
return NO_MEMORY; return NO_MEMORY;
} }