Merge tag 'android-8.1.0_r72' into staging/lineage-15.1_merge-android-8.1.0_r72

Android 8.1.0 release 72

* tag 'android-8.1.0_r72':
  Sensor: use FlattenableUtils::align
  Fix race between SensorManager ctor and callback
  Free mObjects if no objects left to realloc on resize
  [RESTRICT AUTOMERGE] libbinder: Status: check dataPosition sets.
  libbinder: readCString: no ubsan sub-overflow
  Zero-initialize HIDL structs before passing
  Sanitize InputMessage before sending
  libui: add boundary check to GraphicBuffer::unflatten
  Increment when attempting to read protected Parcel Data
  Don't pad before calling writeInPlace().
  Disallow reading object data from Parcels with non-object reads
  Add bounds check to sensors direct channel creation
  surfaceflinger: make vsync injection more robust

Change-Id: I615ab9998112f67f22d703baef992507990e319b

1 files changed, 2 insertions, 1 deletions

diff --git a/libs/sensor/Sensor.cpp b/libs/sensor/Sensor.cpp
index a0e368c7e..2383516c9 100644
--- a/libs/sensor/Sensor.cpp
+++ b/libs/sensor/Sensor.cpp
@@ -562,7 +562,8 @@ void Sensor::flattenString8(void*& buffer, size_t& size,
     uint32_t len = static_cast<uint32_t>(string8.length());
     FlattenableUtils::write(buffer, size, len);
     memcpy(static_cast<char*>(buffer), string8.string(), len);
-    FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len));
+    FlattenableUtils::advance(buffer, size, len);
+    size -= FlattenableUtils::align<4>(buffer);
 }
 
 bool Sensor::unflattenString8(void const*& buffer, size_t& size, String8& outputString8) {