diff --git a/include/input/Input.h b/include/input/Input.h index e77807634..97101a771 100644 --- a/include/input/Input.h +++ b/include/input/Input.h @@ -81,6 +81,11 @@ enum { */ #define MAX_POINTERS 16 +/* + * Maximum number of samples supported per motion event. + */ +#define MAX_SAMPLES UINT16_MAX + /* * Maximum pointer id value supported in a motion event. * Smallest pointer id is 0. diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp index 6f53996b4..83e241c4e 100644 --- a/libs/input/Input.cpp +++ b/libs/input/Input.cpp @@ -490,7 +490,8 @@ void MotionEvent::transform(const float matrix[9]) { status_t MotionEvent::readFromParcel(Parcel* parcel) { size_t pointerCount = parcel->readInt32(); size_t sampleCount = parcel->readInt32(); - if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) { + if (pointerCount == 0 || pointerCount > MAX_POINTERS || + sampleCount == 0 || sampleCount > MAX_SAMPLES) { return BAD_VALUE; }