Merge tag 'LA.UM.5.5.r1-05300-8x96.0' into HEADcm-14.1-caf-8996-20170913

"LA.UM.5.5.r1-05300-8x96.0"

2 files changed, 23 insertions, 11 deletions

diff --git a/hdmi_cec/qhdmi_cec.cpp b/hdmi_cec/qhdmi_cec.cpp
index f84cf8097..0923d9227 100644
--- a/hdmi_cec/qhdmi_cec.cpp
+++ b/hdmi_cec/qhdmi_cec.cpp
@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2014, 2016, The Linux Foundation. All rights reserved.
+* Copyright (c) 2014, 2016-2017, The Linux Foundation. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
@@ -296,8 +296,10 @@ void cec_receive_message(cec_context_t *ctx, char *msg, ssize_t len)
     event.cec.initiator = (cec_logical_address_t) msg[CEC_OFFSET_SENDER_ID];
     event.cec.destination = (cec_logical_address_t) msg[CEC_OFFSET_RECEIVER_ID];
     //Copy opcode and operand
-    memcpy(event.cec.body, &msg[CEC_OFFSET_OPCODE], event.cec.length);
-    hex_to_string((char *) event.cec.body, event.cec.length, dump);
+    size_t copy_size = event.cec.length > sizeof(event.cec.body) ?
+                       sizeof(event.cec.body) : event.cec.length;
+    memcpy(event.cec.body, &msg[CEC_OFFSET_OPCODE],copy_size);
+    hex_to_string((char *) event.cec.body, copy_size, dump);
     ALOGD_IF(DEBUG, "%s: Message to framework: %s", __FUNCTION__, dump);
     ctx->callback.callback_func(&event, ctx->callback.callback_arg);
 }
diff --git a/libmemtrack/kgsl.c b/libmemtrack/kgsl.c
index 877b54ee2..83102a0d0 100644
--- a/libmemtrack/kgsl.c
+++ b/libmemtrack/kgsl.c
@@ -93,31 +93,41 @@ int kgsl_memtrack_get_memory(pid_t pid, enum memtrack_type type,
             continue;
         }
 
-        if (size == 0)
+        if (size == 0) {
+            fclose(fp);
             return -EINVAL;
+        }
 
-        if (unaccounted_size + size < size)
+        if (unaccounted_size + size < size) {
+            fclose(fp);
             return -ERANGE;
+        }
 
         if (type == MEMTRACK_TYPE_GL && strcmp(line_type, "gpumem") == 0) {
 
             if (flags[6] == 'Y') {
-                if (accounted_size + mapsize < accounted_size)
+                if (accounted_size + mapsize < accounted_size) {
+                    fclose(fp);
                     return -ERANGE;
+                }
 
                 accounted_size += mapsize;
 
-                if (mapsize > size)
+                if (mapsize > size) {
+                    fclose(fp);
                     return -EINVAL;
-
+                }
                 unaccounted_size += size - mapsize;
-            } else
+            } else {
                 unaccounted_size += size;
+            }
         } else if (type == MEMTRACK_TYPE_GRAPHICS && strcmp(line_type, "ion") == 0) {
-            if (strcmp(line_usage, "egl_surface") == 0)
+            if (strcmp(line_usage, "egl_surface") == 0) {
                 unaccounted_size += size;
-            else if (egl_surface_count == 0)
+            }
+            else if (egl_surface_count == 0) {
                 unaccounted_size += size / (egl_image_count ? egl_image_count : 1);
+            }
         }
     }