diff options
| author | 2015-09-21 17:28:04 -0700 | |
|---|---|---|
| committer | 2015-09-21 17:44:55 -0700 | |
| commit | 12ba0f57d028a9c8f4eb3afddc326b70677d1e0c (patch) | |
| tree | df6905658b868c056abba37976f92efc578a0e0e | |
| parent | 3ffddbbc0ff521f9b1fe3267a5ec5d22e0ca1829 (diff) | |
Initialize local variables to avoid data leak
The uninitialized local variables pick up
whatever the memory content was there on stack.
This data gets sent to the remote process in
case of a failed transaction, which is a security
issue. Fixed.
For b/23696300
Change-Id: Ie37a34851ffe203f9579f63f1fe1b8605a880c30
| -rw-r--r-- | libs/gui/IGraphicBufferProducer.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp index 6495aa9f12..8d874cdc1c 100644 --- a/libs/gui/IGraphicBufferProducer.cpp +++ b/libs/gui/IGraphicBufferProducer.cpp @@ -371,7 +371,7 @@ status_t BnGraphicBufferProducer::onTransact( uint32_t height = data.readUint32(); PixelFormat format = static_cast<PixelFormat>(data.readInt32()); uint32_t usage = data.readUint32(); - int buf; + int buf = 0; sp<Fence> fence; int result = dequeueBuffer(&buf, &fence, async, width, height, format, usage); @@ -412,7 +412,7 @@ status_t BnGraphicBufferProducer::onTransact( CHECK_INTERFACE(IGraphicBufferProducer, data, reply); sp<GraphicBuffer> buffer = new GraphicBuffer(); data.read(*buffer.get()); - int slot; + int slot = 0; int result = attachBuffer(&slot, buffer); reply->writeInt32(slot); reply->writeInt32(result); @@ -439,7 +439,7 @@ status_t BnGraphicBufferProducer::onTransact( } case QUERY: { CHECK_INTERFACE(IGraphicBufferProducer, data, reply); - int value; + int value = 0; int what = data.readInt32(); int res = query(what, &value); reply->writeInt32(value); |