commit 16110b86db164e8d2b6864fed58f0385fe7d0979
author Fabien Sanglard <sanglardf@google.com> Mon Dec 05 15:06:29 2016 -0800
committer gitbuildkicker <android-build@google.com> Mon Dec 19 14:41:21 2016 -0800
tree 2b63da15310105f86dbaf79f95b89b21de1d9aa1
parent 2e16d5fac149dab3c3e8f1b2ca89f45cf55a7b34

Fix security vulneratibly 31960359

BufferQueueCore features a variable mLastQueuedSlot which is not
initialized in its constructor resulting in security vulnerability

Bug: 31960359
Change-Id: If892f59f6288d8b81b1e312995832a20c8341494
Tests: Manually on Angler
(cherry picked from commit dffa078205f6b6c17e24214928f642393423e081)

libs/gui/BufferQueueCore.cpp

diff --git a/libs/gui/BufferQueueCore.cpp b/libs/gui/BufferQueueCore.cpp
index 9cb9c62..4f6ecff 100644
--- a/libs/gui/BufferQueueCore.cpp
+++ b/libs/gui/BufferQueueCore.cpp
@@ -89,6 +89,7 @@
     mSharedBufferSlot(INVALID_BUFFER_SLOT),
     mSharedBufferCache(Rect::INVALID_RECT, 0, NATIVE_WINDOW_SCALING_MODE_FREEZE,
             HAL_DATASPACE_UNKNOWN),
+    mLastQueuedSlot(INVALID_BUFFER_SLOT),
     mUniqueId(getUniqueId())
 {
     if (allocator == NULL) {