Merge "TouchExplorer: log malformed events instead of crashing." into sc-dev

1 files changed, 32 insertions, 1 deletions

diff --git a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
index e1af2c48789f..d7bc04091181 100644
--- a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
+++ b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
@@ -258,7 +258,12 @@ public class TouchExplorer extends BaseEventStreamTransformation
             super.onMotionEvent(event, rawEvent, policyFlags);
             return;
         }
-
+        try {
+            checkForMalformedEvent(event);
+        } catch (IllegalArgumentException e) {
+            Slog.e(LOG_TAG, "Ignoring malformed event: " + event.toString(), e);
+            return;
+        }
         if (DEBUG) {
             Slog.d(LOG_TAG, "Received event: " + event + ", policyFlags=0x"
                     + Integer.toHexString(policyFlags));
@@ -1223,6 +1228,32 @@ public class TouchExplorer extends BaseEventStreamTransformation
     }
 
     /**
+     * Checks to see whether an event is consistent with itself.
+     *
+     * @throws IllegalArgumentException in the case of a malformed event.
+     */
+    private static void checkForMalformedEvent(MotionEvent event) {
+        if (event.getPointerCount() < 0) {
+            throw new IllegalArgumentException("Invalid pointer count: " + event.getPointerCount());
+        }
+        for (int i = 0; i < event.getPointerCount(); ++i) {
+            try {
+                int pointerId = event.getPointerId(i);
+                float x = event.getX(i);
+                float y = event.getY(i);
+                if (Float.isNaN(x) || Float.isNaN(y) || x < 0.0f || y < 0.0f) {
+                    throw new IllegalArgumentException(
+                            "Invalid coordinates: (" + x + ", " + y + ")");
+                }
+            } catch (Exception e) {
+                throw new IllegalArgumentException(
+                        "Encountered exception getting details of pointer " + i + " / "
+                                + event.getPointerCount(), e);
+            }
+        }
+    }
+
+    /**
      * Class for delayed sending of hover enter and move events.
      */
     class SendHoverEnterAndMoveDelayed implements Runnable {