libgui: layer_state_t::read() check null

layer_state_t::read() check null for color_transform

Bug: 161319576
Test: boot ok
Test: Service Fuzz
Change-Id: I0d466a9b1d2f6b57cd5f8ddce79da3d7f0a1725a

1 files changed, 6 insertions, 1 deletions

diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index e43446ac8c..0281279d69 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -176,7 +176,12 @@ status_t layer_state_t::read(const Parcel& input)
         sidebandStream = NativeHandle::create(input.readNativeHandle(), true);
     }
 
-    colorTransform = mat4(static_cast<const float*>(input.readInplace(16 * sizeof(float))));
+    const void* color_transform_data = input.readInplace(16 * sizeof(float));
+    if (color_transform_data) {
+        colorTransform = mat4(static_cast<const float*>(color_transform_data));
+    } else {
+        return BAD_VALUE;
+    }
     cornerRadius = input.readFloat();
     backgroundBlurRadius = input.readUint32();
     cachedBuffer.token = input.readStrongBinder();