From bb27bcd9c676f65937a2637d8c400d491d655f54 Mon Sep 17 00:00:00 2001 From: Kevin DuBois Date: Tue, 2 Apr 2019 14:34:35 -0700 Subject: SF: fix off-by one in luma mean calculation There was an off by one error in luma mean calculation that could lead to segfault. Flaw was figured out in writing the 5 attached unit tests for the function. Condition would be obscure in the wild, but an exactly half-white, half-another-color in the sampled region could present condition. Fixes: 129858549 Test: libsurfaceflinger_unittest (5 new tests) Change-Id: I920cd9cac15122178ec9258e33c9bc35b1bb9357 --- services/surfaceflinger/RegionSamplingThread.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'services/surfaceflinger/RegionSamplingThread.cpp') diff --git a/services/surfaceflinger/RegionSamplingThread.cpp b/services/surfaceflinger/RegionSamplingThread.cpp index 718e996dae..35f11fc494 100644 --- a/services/surfaceflinger/RegionSamplingThread.cpp +++ b/services/surfaceflinger/RegionSamplingThread.cpp @@ -266,6 +266,7 @@ float getLuma(float r, float g, float b) { constexpr auto rec709_blue_primary = 0.0722f; return rec709_red_primary * r + rec709_green_primary * g + rec709_blue_primary * b; } +} // anonymous namespace float sampleArea(const uint32_t* data, int32_t stride, const Rect& area) { std::array brightnessBuckets = {}; @@ -286,14 +287,13 @@ float sampleArea(const uint32_t* data, int32_t stride, const Rect& area) { int32_t accumulated = 0; size_t bucket = 0; - while (bucket++ < brightnessBuckets.size()) { + for (; bucket < brightnessBuckets.size(); bucket++) { accumulated += brightnessBuckets[bucket]; if (accumulated > majoritySampleNum) break; } return bucket / 255.0f; } -} // anonymous namespace std::vector RegionSamplingThread::sampleBuffer( const sp& buffer, const Point& leftTop, -- cgit v1.2.3-59-g8ed1b