Fix null pointer deref in libsensor SensorServer
When trying to create a senor direct connection, check that native
handle resource is not null, and if so return BAD_VALUE error.
Bug: 135051254
Test: Load onto device and try "service call sensorservice 5"
commands that have no arguments and random arguments. Both throw new error
and do not crash system as hoped.
Change-Id: Ie2eaf1a17843da89927293e408768bfbaaf86ec8
diff --git a/libs/sensor/ISensorServer.cpp b/libs/sensor/ISensorServer.cpp
index 5200545..8ed09f8 100644
--- a/libs/sensor/ISensorServer.cpp
+++ b/libs/sensor/ISensorServer.cpp
@@ -199,6 +199,10 @@
int32_t type = data.readInt32();
int32_t format = data.readInt32();
native_handle_t *resource = data.readNativeHandle();
+ // Avoid a crash in native_handle_close if resource is nullptr
+ if (resource == nullptr) {
+ return BAD_VALUE;
+ }
sp<ISensorEventConnection> ch =
createSensorDirectConnection(opPackageName, size, type, format, resource);
native_handle_close(resource);