Store coords and properties as vector in args
Before this CL, NotifyMotionArgs stored PointerCoords and
PointerProperties in a fixed-size array. Upon creation of a new object,
some of that data typically remained uninitialized.
At the same time, the copy assignment operator was defaulted, which
meant that the uninitialized data was getting accessed in order to copy
the object.
The sanitizers identify this as a problem and crash.
To fix this, store these objects inside vectors.
Bug: 271455682
Test: atest inputflinger_tests
Change-Id: I9dba29f75df59a21f8ed7fd0f46fd1f6d45f2eef
diff --git a/services/inputflinger/UnwantedInteractionBlocker.cpp b/services/inputflinger/UnwantedInteractionBlocker.cpp
index 02bc47d..f889de5 100644
--- a/services/inputflinger/UnwantedInteractionBlocker.cpp
+++ b/services/inputflinger/UnwantedInteractionBlocker.cpp
@@ -117,7 +117,7 @@
}
static int32_t getActionUpForPointerId(const NotifyMotionArgs& args, int32_t pointerId) {
- for (size_t i = 0; i < args.pointerCount; i++) {
+ for (size_t i = 0; i < args.getPointerCount(); i++) {
if (pointerId == args.pointerProperties[i].id) {
return AMOTION_EVENT_ACTION_POINTER_UP |
(i << AMOTION_EVENT_ACTION_POINTER_INDEX_SHIFT);
@@ -156,9 +156,10 @@
actionMasked == AMOTION_EVENT_ACTION_POINTER_UP;
NotifyMotionArgs newArgs{args};
- newArgs.pointerCount = 0;
+ newArgs.pointerProperties.clear();
+ newArgs.pointerCoords.clear();
int32_t newActionIndex = 0;
- for (uint32_t i = 0; i < args.pointerCount; i++) {
+ for (uint32_t i = 0; i < args.getPointerCount(); i++) {
const int32_t pointerId = args.pointerProperties[i].id;
if (pointerIds.find(pointerId) != pointerIds.end()) {
// skip this pointer
@@ -170,19 +171,18 @@
}
continue;
}
- newArgs.pointerProperties[newArgs.pointerCount].copyFrom(args.pointerProperties[i]);
- newArgs.pointerCoords[newArgs.pointerCount].copyFrom(args.pointerCoords[i]);
+ newArgs.pointerProperties.push_back(args.pointerProperties[i]);
+ newArgs.pointerCoords.push_back(args.pointerCoords[i]);
if (i == actionIndex) {
- newActionIndex = newArgs.pointerCount;
+ newActionIndex = newArgs.getPointerCount() - 1;
}
- newArgs.pointerCount++;
}
// Update POINTER_DOWN or POINTER_UP actions
if (isPointerUpOrDownAction && newArgs.action != ACTION_UNKNOWN) {
newArgs.action =
actionMasked | (newActionIndex << AMOTION_EVENT_ACTION_POINTER_INDEX_SHIFT);
// Convert POINTER_DOWN and POINTER_UP to DOWN and UP if there's only 1 pointer remaining
- if (newArgs.pointerCount == 1) {
+ if (newArgs.getPointerCount() == 1) {
if (actionMasked == AMOTION_EVENT_ACTION_POINTER_DOWN) {
newArgs.action = AMOTION_EVENT_ACTION_DOWN;
} else if (actionMasked == AMOTION_EVENT_ACTION_POINTER_UP) {
@@ -201,13 +201,14 @@
*/
static std::optional<NotifyMotionArgs> removeStylusPointerIds(const NotifyMotionArgs& args) {
std::set<int32_t> stylusPointerIds;
- for (uint32_t i = 0; i < args.pointerCount; i++) {
+ for (uint32_t i = 0; i < args.getPointerCount(); i++) {
if (isStylusToolType(args.pointerProperties[i].toolType)) {
stylusPointerIds.insert(args.pointerProperties[i].id);
}
}
NotifyMotionArgs withoutStylusPointers = removePointerIds(args, stylusPointerIds);
- if (withoutStylusPointers.pointerCount == 0 || withoutStylusPointers.action == ACTION_UNKNOWN) {
+ if (withoutStylusPointers.getPointerCount() == 0 ||
+ withoutStylusPointers.action == ACTION_UNKNOWN) {
return std::nullopt;
}
return withoutStylusPointers;
@@ -272,7 +273,7 @@
std::vector<NotifyMotionArgs> cancelSuppressedPointers(
const NotifyMotionArgs& args, const std::set<int32_t>& oldSuppressedPointerIds,
const std::set<int32_t>& newSuppressedPointerIds) {
- LOG_ALWAYS_FATAL_IF(args.pointerCount == 0, "0 pointers in %s", args.dump().c_str());
+ LOG_ALWAYS_FATAL_IF(args.getPointerCount() == 0, "0 pointers in %s", args.dump().c_str());
// First, let's remove the old suppressed pointers. They've already been canceled previously.
NotifyMotionArgs oldArgs = removePointerIds(args, oldSuppressedPointerIds);
@@ -284,7 +285,7 @@
const int32_t actionMasked = MotionEvent::getActionMasked(args.action);
// We will iteratively remove pointers from 'removedArgs'.
NotifyMotionArgs removedArgs{oldArgs};
- for (uint32_t i = 0; i < oldArgs.pointerCount; i++) {
+ for (uint32_t i = 0; i < oldArgs.getPointerCount(); i++) {
const int32_t pointerId = oldArgs.pointerProperties[i].id;
if (newSuppressedPointerIds.find(pointerId) == newSuppressedPointerIds.end()) {
// This is a pointer that should not be canceled. Move on.
@@ -296,7 +297,7 @@
continue;
}
- if (removedArgs.pointerCount == 1) {
+ if (removedArgs.getPointerCount() == 1) {
// We are about to remove the last pointer, which means there will be no more gesture
// remaining. This is identical to canceling all pointers, so just send a single CANCEL
// event, without any of the preceding POINTER_UP with FLAG_CANCELED events.
@@ -314,7 +315,7 @@
}
// Now 'removedArgs' contains only pointers that are valid.
- if (removedArgs.pointerCount <= 0 || removedArgs.action == ACTION_UNKNOWN) {
+ if (removedArgs.getPointerCount() <= 0 || removedArgs.action == ACTION_UNKNOWN) {
return out;
}
out.push_back(removedArgs);
@@ -473,7 +474,7 @@
UnwantedInteractionBlocker::~UnwantedInteractionBlocker() {}
void SlotState::update(const NotifyMotionArgs& args) {
- for (size_t i = 0; i < args.pointerCount; i++) {
+ for (size_t i = 0; i < args.getPointerCount(); i++) {
const int32_t pointerId = args.pointerProperties[i].id;
const int32_t resolvedAction = resolveActionForPointer(i, args.action);
processPointerId(pointerId, resolvedAction);
@@ -571,7 +572,7 @@
const SlotState& newSlotState) {
std::vector<::ui::InProgressTouchEvdev> touches;
- for (size_t i = 0; i < args.pointerCount; i++) {
+ for (size_t i = 0; i < args.getPointerCount(); i++) {
const int32_t pointerId = args.pointerProperties[i].id;
touches.emplace_back(::ui::InProgressTouchEvdev());
touches.back().major = args.pointerCoords[i].getAxisValue(AMOTION_EVENT_AXIS_TOUCH_MAJOR);
@@ -660,7 +661,7 @@
// Now that we know which slots should be suppressed, let's convert those to pointer id's.
std::set<int32_t> newSuppressedIds;
- for (size_t i = 0; i < args.pointerCount; i++) {
+ for (size_t i = 0; i < args.getPointerCount(); i++) {
const int32_t pointerId = args.pointerProperties[i].id;
std::optional<size_t> slot = oldSlotState.getSlotForPointerId(pointerId);
if (!slot) {