replicant-frameworks_native/libs/gui
Dan Stoza c5fe5044f4 libgui: Check slot received from IGBP in Surface
Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.

Bug: 36991414
AOSP-Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
(cherry picked from commit 90ce2a9c1d3af422c66b4061805831cb208263d8)

CVE-2017-0665

Change-Id: If0fd4864b9fc4ea5a1c83d10adef26cdabb0f7e8
2017-07-06 21:31:56 +02:00
..
tests libgui/SurfaceFlinger: Add getConsumerName 2015-06-08 09:40:49 -07:00
Android.mk sensor: Allow devices to skip the permission request 2015-12-18 15:21:53 -08:00
BitTube.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
BufferItem.cpp fix BufferItem flatten/unflatten alignment 2015-05-22 10:54:25 -07:00
BufferItemConsumer.cpp Refactor ConsumerBase and it's derived classes. 2015-05-18 14:29:18 -07:00
BufferQueue.cpp libgui: Hook up onFrameReplaced 2015-05-11 15:33:01 -07:00
BufferQueueConsumer.cpp Fix SF security vulnerability: 32660278 2017-01-13 11:47:31 +01:00
BufferQueueCore.cpp libgui: Add generation numbers to BufferQueue 2015-06-03 11:09:33 -07:00
BufferQueueProducer.cpp Fix SF security vulnerability: 32706020 2017-03-13 04:56:11 +00:00
BufferSlot.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
CleanSpec.mk
ConsumerBase.cpp Merge "Refactor ConsumerBase and it's derived classes." into mnc-dev 2015-05-18 21:29:39 +00:00
CpuConsumer.cpp Refactor ConsumerBase and it's derived classes. 2015-05-18 14:29:18 -07:00
DisplayEventReceiver.cpp
GLConsumer.cpp GLConsumer: Fix crop math 2015-06-10 10:24:51 -07:00
GraphicBufferAlloc.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
GuiConfig.cpp
IConsumerListener.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
IDisplayEventConnection.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
IGraphicBufferAlloc.cpp libgui: Propagate error by clearing sp<GB> 2015-06-01 13:59:15 -07:00
IGraphicBufferConsumer.cpp BQ: fix some uninitialized variables 2016-03-25 17:47:54 -07:00
IGraphicBufferProducer.cpp BQ: fix some uninitialized variables 2016-03-25 17:47:54 -07:00
IProducerListener.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
ISensorEventConnection.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
ISensorServer.cpp Enable sensor data injection mode through adb. 2015-06-30 14:59:58 -07:00
ISurfaceComposer.cpp Bring back support for glReadPixels screenshot path 2015-10-16 14:45:10 -07:00
ISurfaceComposerClient.cpp libgui: Enable -Weverything and -Werror 2015-03-18 15:57:27 -07:00
LayerState.cpp SurfaceFlinger: Native changes to add blur effect 2015-11-08 01:07:13 -08:00
Sensor.cpp sensor: Skip additional permission request checks 2015-12-21 08:54:18 -08:00
SensorEventQueue.cpp Enable sensor data injection mode through adb. 2015-06-30 14:59:58 -07:00
SensorManager.cpp SensorManager fixes. 2015-08-25 11:24:02 -07:00
StreamSplitter.cpp DO NOT MERGE libgui: Prepare for IGBC::BufferItem removal 2015-03-19 13:58:07 -07:00
Surface.cpp libgui: Check slot received from IGBP in Surface 2017-07-06 21:31:56 +02:00
SurfaceComposerClient.cpp SurfaceFlinger: Native changes to add blur effect 2015-11-08 01:07:13 -08:00
SurfaceControl.cpp SurfaceFlinger: Native changes to add blur effect 2015-11-08 01:07:13 -08:00
SyncFeatures.cpp libgui: Only allow one return from useFenceSync 2015-03-19 10:32:51 -07:00