tree aaf987076aeb9cbc2c9187b2c8582df52da5b5f3
parent d04d08d1c78c6455f5e2d883844076ece94b235f
author Robert Carr <racarr@google.com> 1599009989 -0700
committer android-build-team Robot <android-build-team-robot@google.com> 1603832245 +0000

DO NOT MERGE: fillInputInfo: Guard against integer overflow.

We have a bunch of bug-reports where we are seeing an abort inside
Rect::inset during/after rotation animations. I can't think of any
reason Rect::inset would abort besides integer overflow. I'm also not
sure what exact state the layer was in, because at the time of the
report SurfaceFlinger has already crashed. I also can't reproduce. So
it's a little difficult to figure out how we actually ended up
overflowing here. I guess some math must have gone very wrong during
the rotation animation calculation, though apparently on a non-visible layer
or only for one frame or something, because no-one reports any visible
issues. For lack of anything better to do now, I'm going to sanitize
the function against integer overflow on the theory that SurfaceFlinger
should at least be resistant against invalid input. I also wonder if
something has gone wrong in the SF math, because we may be applying
a non rect preserving transform to the rect...but when I work through
examples I can't see exactly how it would lead to overflow.

Bug: 166217947
Test: Existing tests pass
Change-Id: I7d989d5be77595f88b2c52fa69c3ed29d17d3931
(cherry picked from commit a724230a325aca0e85dfd874e75f9631ac731093)
(cherry picked from commit 669090928a6a6e87f36d07d63c14ea1b97f38d37)