commit faa7a7841f1e87ba2e9553a25509718686d963b3
author Flanker <i@flanker017.me> Mon Sep 07 15:28:58 2015 +0800
committer The Android Automerger <android-build@google.com> Tue Oct 27 15:22:35 2015 -0700
tree 809a8f2e16dd1424d9746e6a33107fb82fd6276e
parent 846d747274455c58acf933794baef65c07502a2c

add number constraint for samples per MotionEvent

Bug:23905002

Signed-off-by: Adam Lesinski <adamlesinski@google.com>

(cherry picked from commit 552a8a5d8df32f659b8d11311a244cdc6d3b7733)

Change-Id: I9b7ea859889b7697bee4165a2746602212120543

include/input/Input.h

diff --git a/include/input/Input.h b/include/input/Input.h
index 4a67f47..92b3d36 100644
--- a/include/input/Input.h
+++ b/include/input/Input.h
@@ -111,6 +111,11 @@
 #define MAX_POINTERS 16
 
 /*
+ * Maximum number of samples supported per motion event.
+ */
+#define MAX_SAMPLES UINT16_MAX
+
+/*
  * Maximum pointer id value supported in a motion event.
  * Smallest pointer id is 0.
  * (This is limited by our use of BitSet32 to track pointer assignments.)

libs/input/Input.cpp

diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index 2c1418e..b64cb2c 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -424,7 +424,8 @@
 status_t MotionEvent::readFromParcel(Parcel* parcel) {
     size_t pointerCount = parcel->readInt32();
     size_t sampleCount = parcel->readInt32();
-    if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) {
+    if (pointerCount == 0 || pointerCount > MAX_POINTERS ||
+            sampleCount == 0 || sampleCount > MAX_SAMPLES) {
         return BAD_VALUE;
     }