commit 99f44e251b76171d09dd452361c63540e4716194
author Pawan Wagh <waghpawan@google.com> Wed Jul 05 21:26:43 2023 +0000
committer Pawan Wagh <waghpawan@google.com> Wed Jul 05 22:48:39 2023 +0000
tree cd49289f3cbb614d01d387f5bf26b8375a8b777e
parent 3d87c778b2d2a5ae275a840beb0f585866d9232c

Fix null deref in camera service

Returning exception when empty args are passed
to notifySystemEvents.

Test: m camera_service_aidl_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/camera_service_aidl_fuzzer/camera_service_aidl_fuzzer
Bug: 289668975
Change-Id: I795f16dfb8b40c0a0d75762e195bd5d1123cf135

services/camera/libcameraservice/CameraService.cpp

diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index 8bfa588..6ce2950 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -2456,6 +2456,11 @@
         }
         case ICameraService::EVENT_USB_DEVICE_ATTACHED:
         case ICameraService::EVENT_USB_DEVICE_DETACHED: {
+            if (args.size() != 1) {
+                return Status::fromExceptionCode(Status::EX_ILLEGAL_ARGUMENT,
+                    "USB Device Event requires 1 argument");
+            }
+
             // Notify CameraProviderManager for lazy HALs
             mCameraProviderManager->notifyUsbDeviceEvent(eventId,
                                                         std::to_string(args[0]));