summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
author Naveen Leekha <leekha@google.com> 2015-09-21 17:28:04 -0700
committer Naveen Leekha <leekha@google.com> 2015-09-21 17:44:55 -0700
commit12ba0f57d028a9c8f4eb3afddc326b70677d1e0c (patch)
treedf6905658b868c056abba37976f92efc578a0e0e
parent3ffddbbc0ff521f9b1fe3267a5ec5d22e0ca1829 (diff)
Initialize local variables to avoid data leak
The uninitialized local variables pick up whatever the memory content was there on stack. This data gets sent to the remote process in case of a failed transaction, which is a security issue. Fixed. For b/23696300 Change-Id: Ie37a34851ffe203f9579f63f1fe1b8605a880c30
-rw-r--r--libs/gui/IGraphicBufferProducer.cpp6
1 files changed, 3 insertions, 3 deletions
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 6495aa9f12..8d874cdc1c 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -371,7 +371,7 @@ status_t BnGraphicBufferProducer::onTransact(
uint32_t height = data.readUint32();
PixelFormat format = static_cast<PixelFormat>(data.readInt32());
uint32_t usage = data.readUint32();
- int buf;
+ int buf = 0;
sp<Fence> fence;
int result = dequeueBuffer(&buf, &fence, async, width, height,
format, usage);
@@ -412,7 +412,7 @@ status_t BnGraphicBufferProducer::onTransact(
CHECK_INTERFACE(IGraphicBufferProducer, data, reply);
sp<GraphicBuffer> buffer = new GraphicBuffer();
data.read(*buffer.get());
- int slot;
+ int slot = 0;
int result = attachBuffer(&slot, buffer);
reply->writeInt32(slot);
reply->writeInt32(result);
@@ -439,7 +439,7 @@ status_t BnGraphicBufferProducer::onTransact(
}
case QUERY: {
CHECK_INTERFACE(IGraphicBufferProducer, data, reply);
- int value;
+ int value = 0;
int what = data.readInt32();
int res = query(what, &value);
reply->writeInt32(value);