add number constraint for samples per MotionEvent

Bug:23905002

Signed-off-by: Adam Lesinski <adamlesinski@google.com>

(cherry picked from commit 552a8a5d8d)

Change-Id: I9b7ea859889b7697bee4165a2746602212120543
This commit is contained in:
Flanker 2015-09-07 15:28:58 +08:00 committed by Nick Kralevich
parent c1e6fbb52c
commit 5d17838ade
2 changed files with 7 additions and 1 deletions

View File

@ -81,6 +81,11 @@ enum {
*/
#define MAX_POINTERS 16
/*
* Maximum number of samples supported per motion event.
*/
#define MAX_SAMPLES UINT16_MAX
/*
* Maximum pointer id value supported in a motion event.
* Smallest pointer id is 0.

View File

@ -490,7 +490,8 @@ void MotionEvent::transform(const float matrix[9]) {
status_t MotionEvent::readFromParcel(Parcel* parcel) {
size_t pointerCount = parcel->readInt32();
size_t sampleCount = parcel->readInt32();
if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) {
if (pointerCount == 0 || pointerCount > MAX_POINTERS ||
sampleCount == 0 || sampleCount > MAX_SAMPLES) {
return BAD_VALUE;
}