commit 2fe15aa6f00b3c58e4dda26d2c117e422056ffa1
author Dan Stoza <stoza@google.com> Tue May 16 20:49:46 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue May 16 20:49:46 2017 +0000
tree 0a83bed0b1a113a12b7e04dfdd2d4ea209b039f0
parent d4cbd296d66d788fd1867d21cae3b4df37fe93b9
parent 78976cea8fd8bbd63630ce550e29cf0eb8691b98

Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am: 98e3c06010 am: 970bb51580
am: 78976cea8f

Change-Id: I30e6a29474b6cf86f97961f527301837b35c8a36

libs/gui/Surface.cpp

diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 4b76f98..22aa4ec 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -237,6 +237,12 @@
         return result;
     }
 
+    if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+        ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+        android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+        return FAILED_TRANSACTION;
+    }
+
     Mutex::Autolock lock(mMutex);
 
     sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);