ADHOC
/
replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SurfaceFlinger: Fix integer overflow in Mesh ctor 

Performs range checking on the inputs to Mesh::Mesh() before allocating
the storage array.

Bug: 20674682
Change-Id: I4fc918a8c312d967dd6d9f91a098b2e0a7081027
(cherry picked from commit ab79e33ef3)
This commit is contained in:
Dan Stoza 2015-04-29 13:30:31 -07:00
parent 84f1d9c288
commit aa4041f70a
1 changed files with 28 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
services/surfaceflinger/RenderEngine/Mesh.cpp
View File

@ -16,14 +16,40 @@
#include "Mesh.h"
#include <utils/Log.h>
namespace android {
Mesh::Mesh(Primitive primitive, size_t vertexCount, size_t vertexSize, size_t texCoordSize)
: mVertexCount(vertexCount), mVertexSize(vertexSize), mTexCoordsSize(texCoordSize),
mPrimitive(primitive)
{
mVertices = new float[(vertexSize + texCoordSize) * vertexCount];
mStride = mVertexSize + mTexCoordsSize;
if (vertexCount == 0) {
mVertices = new float[1];
mVertices[0] = 0.0f;
mStride = 0;
return;
}
size_t stride = vertexSize + texCoordSize;
size_t remainder = (stride * vertexCount) / vertexCount;
// Since all of the input parameters are unsigned, if stride is less than
// either vertexSize or texCoordSize, it must have overflowed. remainder
// will be equal to stride as long as stride * vertexCount doesn't overflow.
if ((stride < vertexSize) || (remainder != stride)) {
ALOGE("Overflow in Mesh(..., %zu, %zu, %zu)", vertexCount, vertexSize,
texCoordSize);
mVertices = new float[1];
mVertices[0] = 0.0f;
mVertexCount = 0;
mVertexSize = 0;
mTexCoordsSize = 0;
mStride = 0;
return;
}
mVertices = new float[stride * vertexCount];
mStride = stride;
}
Mesh::~Mesh() {