release-request-556939d2-cc5e-453a-b797-8a7cb6dacac2-for-git_nyc-mr1-security-f-release-4118426 snap-temp-L72200000081371809
Change-Id: I30be229e127cfd6c81d29d67e6b884d0df7e8411
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index 05923b5..ce47784 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -921,7 +921,11 @@
// Call back without the main BufferQueue lock held, but with the callback
// lock held so we can ensure that callbacks occur in order
- {
+
+ int connectedApi;
+ sp<Fence> lastQueuedFence;
+
+ { // scope for the lock
Mutex::Autolock lock(mCallbackMutex);
while (callbackTicket != mCurrentCallbackTicket) {
mCallbackCondition.wait(mCallbackMutex);
@@ -933,20 +937,24 @@
frameReplacedListener->onFrameReplaced(item);
}
+ connectedApi = mCore->mConnectedApi;
+ lastQueuedFence = std::move(mLastQueueBufferFence);
+
+ mLastQueueBufferFence = std::move(fence);
+ mLastQueuedCrop = item.mCrop;
+ mLastQueuedTransform = item.mTransform;
+
++mCurrentCallbackTicket;
mCallbackCondition.broadcast();
}
// Wait without lock held
- if (mCore->mConnectedApi == NATIVE_WINDOW_API_EGL) {
+ if (connectedApi == NATIVE_WINDOW_API_EGL) {
// Waiting here allows for two full buffers to be queued but not a
// third. In the event that frames take varying time, this makes a
// small trade-off in favor of latency rather than throughput.
- mLastQueueBufferFence->waitForever("Throttling EGL Production");
+ lastQueuedFence->waitForever("Throttling EGL Production");
}
- mLastQueueBufferFence = fence;
- mLastQueuedCrop = item.mCrop;
- mLastQueuedTransform = item.mTransform;
return NO_ERROR;
}
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index f4ba3bf..1a08130 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -26,6 +26,7 @@
#include <binder/Parcel.h>
#include <binder/IInterface.h>
+#include <gui/BufferQueueDefs.h>
#include <gui/IGraphicBufferProducer.h>
#include <gui/IProducerListener.h>
@@ -203,8 +204,16 @@
if (result != NO_ERROR) {
return result;
}
+
*slot = reply.readInt32();
result = reply.readInt32();
+ if (result == NO_ERROR &&
+ (*slot < 0 || *slot >= BufferQueueDefs::NUM_BUFFER_SLOTS)) {
+ ALOGE("attachBuffer returned invalid slot %d", *slot);
+ android_errorWriteLog(0x534e4554, "37478824");
+ return UNKNOWN_ERROR;
+ }
+
return result;
}
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 0838290..5a2ca8d 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -306,6 +306,12 @@
return result;
}
+ if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+ ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+ android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+ return FAILED_TRANSACTION;
+ }
+
Mutex::Autolock lock(mMutex);
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);
diff --git a/libs/ui/Fence.cpp b/libs/ui/Fence.cpp
index bf24ffb..1b2f34d 100644
--- a/libs/ui/Fence.cpp
+++ b/libs/ui/Fence.cpp
@@ -157,7 +157,7 @@
return INVALID_OPERATION;
}
- if (size < 1) {
+ if (size < getFlattenedSize()) {
return NO_MEMORY;
}
