Merge "Fix sanitizer in InputFlinger Reader/Dispatcher."

am: bfdea369b7

Change-Id: I69d877f6a7bb2501f97276fe5ff5e16bdc2a2e5b

2 files changed, 6 insertions, 3 deletions

diff --git a/services/inputflinger/InputDispatcher.cpp b/services/inputflinger/InputDispatcher.cpp
index 42f9ba9047..98e135d530 100644
--- a/services/inputflinger/InputDispatcher.cpp
+++ b/services/inputflinger/InputDispatcher.cpp
@@ -2902,7 +2902,7 @@ void InputDispatcher::setInputWindows(const Vector<sp<InputWindowHandle> >& inpu
 
         for (size_t d = 0; d < mTouchStatesByDisplay.size(); d++) {
             TouchState& state = mTouchStatesByDisplay.editValueAt(d);
-            for (size_t i = 0; i < state.windows.size(); i++) {
+            for (size_t i = 0; i < state.windows.size(); ) {
                 TouchedWindow& touchedWindow = state.windows.editItemAt(i);
                 if (!hasWindowHandleLocked(touchedWindow.windowHandle)) {
 #if DEBUG_FOCUS
@@ -2917,7 +2917,9 @@ void InputDispatcher::setInputWindows(const Vector<sp<InputWindowHandle> >& inpu
                         synthesizeCancelationEventsForInputChannelLocked(
                                 touchedInputChannel, options);
                     }
-                    state.windows.removeAt(i--);
+                    state.windows.removeAt(i);
+                } else {
+                  ++i;
                 }
             }
         }
diff --git a/services/inputflinger/InputReader.cpp b/services/inputflinger/InputReader.cpp
index d4266f6df9..420d06b671 100644
--- a/services/inputflinger/InputReader.cpp
+++ b/services/inputflinger/InputReader.cpp
@@ -1174,7 +1174,7 @@ void InputDevice::process(const RawEvent* rawEvents, size_t count) {
     // gamepad button presses are handled by different mappers but they should be dispatched
     // in the order received.
     size_t numMappers = mMappers.size();
-    for (const RawEvent* rawEvent = rawEvents; count--; rawEvent++) {
+    for (const RawEvent* rawEvent = rawEvents; count != 0; rawEvent++) {
 #if DEBUG_RAW_EVENTS
         ALOGD("Input event: device=%d type=0x%04x code=0x%04x value=0x%08x when=%lld",
                 rawEvent->deviceId, rawEvent->type, rawEvent->code, rawEvent->value,
@@ -1202,6 +1202,7 @@ void InputDevice::process(const RawEvent* rawEvents, size_t count) {
                 mapper->process(rawEvent);
             }
         }
+        --count;
     }
 }