diff options
| author | Dan Stoza <stoza@google.com> | 2017-05-01 16:31:53 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2017-05-24 17:21:13 +0000 |
| commit | d3fa90b469129b1f652e1c5beb84d0efaf9fe511 (patch) | |
| tree | dd2b4fe6b15c9588b7fd80c79df1ff5ba9e4df45 | |
| parent | 9ab12528a24526af8de57732902658172c32c9ca (diff) | |
| download | android_frameworks_native-d3fa90b469129b1f652e1c5beb84d0efaf9fe511.tar.gz android_frameworks_native-d3fa90b469129b1f652e1c5beb84d0efaf9fe511.tar.bz2 android_frameworks_native-d3fa90b469129b1f652e1c5beb84d0efaf9fe511.zip | |
libgui: Check slot received from IGBP in Surface
Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.
Bug: 36991414
Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
(cherry picked from commit 90ce2a9c1d3af422c66b4061805831cb208263d8)
| -rw-r--r-- | libs/gui/Surface.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp index 08382908b..5a2ca8d7a 100644 --- a/libs/gui/Surface.cpp +++ b/libs/gui/Surface.cpp @@ -306,6 +306,12 @@ int Surface::dequeueBuffer(android_native_buffer_t** buffer, int* fenceFd) { return result; } + if (buf < 0 || buf >= NUM_BUFFER_SLOTS) { + ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf); + android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging + return FAILED_TRANSACTION; + } + Mutex::Autolock lock(mMutex); sp<GraphicBuffer>& gbuf(mSlots[buf].buffer); |