diff options
| author | 2020-03-05 00:30:48 +0000 | |
|---|---|---|
| committer | 2020-03-05 00:30:48 +0000 | |
| commit | 29e122b35c30c811943453cfb718bf839a737f22 (patch) | |
| tree | 7ed076a6fbff49d4fbabfe4cba675d8435f3ff19 /libs/gui/ISurfaceComposer.cpp | |
| parent | abb891a722ddbcb82f579d00e4f95c54b1bd0c13 (diff) | |
| parent | 0a52509e8cdc6da93daab9c34fdbb63232fa8adf (diff) | |
Merge "ISurfaceComposer: boundary check input on CAPTURE_LAYERS" into rvc-dev
Diffstat (limited to 'libs/gui/ISurfaceComposer.cpp')
| -rw-r--r-- | libs/gui/ISurfaceComposer.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp index ce41eaba1d..04c21a9e1d 100644 --- a/libs/gui/ISurfaceComposer.cpp +++ b/libs/gui/ISurfaceComposer.cpp @@ -1281,6 +1281,9 @@ status_t BnSurfaceComposer::onTransact( std::unordered_set<sp<IBinder>, SpHash<IBinder>> excludeHandles; int numExcludeHandles = data.readInt32(); + if (numExcludeHandles >= static_cast<int>(MAX_LAYERS)) { + return BAD_VALUE; + } excludeHandles.reserve(numExcludeHandles); for (int i = 0; i < numExcludeHandles; i++) { excludeHandles.emplace(data.readStrongBinder()); |