ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

am ef36f2a8: am d17e3b5f: prevent a client from crashing surfaceflinger

Browse Source 
* commit 'ef36f2a84cb8478b0baa299d980922ce7824c0b3':
  prevent a client from crashing surfaceflinger
This commit is contained in:
Mathias Agopian 2012-10-22 15:38:00 -07:00 committed by Android Git Automerger
commit ba0b9cca69
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
services/surfaceflinger/SurfaceFlinger.cpp
View File

@ -1681,8 +1681,23 @@ void SurfaceFlinger::setTransactionState(
count = state.size(); count = state.size();
for (size_t i=0 ; i<count ; i++) { for (size_t i=0 ; i<count ; i++) {
const ComposerState& s(state[i]); const ComposerState& s(state[i]);
sp<Client> client( static_cast<Client *>(s.client.get()) ); // Here we need to check that the interface we're given is indeed
transactionFlags |= setClientStateLocked(client, s.state); // one of our own. A malicious client could give us a NULL
// IInterface, or one of its own or even one of our own but a
// different type. All these situations would cause us to crash.
//
// NOTE: it would be better to use RTTI as we could directly check
// that we have a Client*. however, RTTI is disabled in Android.
if (s.client != NULL) {
sp<IBinder> binder = s.client->asBinder();
if (binder != NULL) {
String16 desc(binder->getInterfaceDescriptor());
if (desc == ISurfaceComposerClient::descriptor) {
sp<Client> client( static_cast<Client *>(s.client.get()) );
transactionFlags |= setClientStateLocked(client, s.state);
}
}
}
} }
if (transactionFlags) { if (transactionFlags) {