summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJesse Hall <jessehall@google.com>2015-08-21 07:41:46 -0700
committerDenis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>2020-01-02 15:47:06 +0100
commitebb41a0b940a355dcfcd07923228fb1fd4edfcd3 (patch)
treef6140e048e1acad23be520786fd3274da5702e37
parentf5f7f5f366d45046f7d67ced4fb27ca5c0877a04 (diff)
downloadframeworks_native-ebb41a0b940a355dcfcd07923228fb1fd4edfcd3.tar.gz
frameworks_native-ebb41a0b940a355dcfcd07923228fb1fd4edfcd3.tar.bz2
frameworks_native-ebb41a0b940a355dcfcd07923228fb1fd4edfcd3.zip
libagl: Fix buffer read overrun in eglCreatePbufferSurface
The code was assuming that EGL_NONE==0, which isn't true. Bug: 23403170 Change-Id: Ic1eccdef086b4d610bd78dbb6b2ae883c91dc322
-rw-r--r--opengl/libagl/egl.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index 593d0c2d0..ee790c921 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -1373,7 +1373,7 @@ static EGLSurface createPbufferSurface(EGLDisplay dpy, EGLConfig config,
int32_t w = 0;
int32_t h = 0;
- while (attrib_list[0]) {
+ while (attrib_list[0] != EGL_NONE) {
if (attrib_list[0] == EGL_WIDTH) w = attrib_list[1];
if (attrib_list[0] == EGL_HEIGHT) h = attrib_list[1];
attrib_list+=2;