Stop illegal FD from causing SensorService crash
If an illegal FD is passed into the SensorService code that sets up
direct connections, it doesn't do any verification before using some
ashmem helpers which will crash the service if an illegal fd is passed
in. Verify any FD is valid before this step to avoid the crash.
Bug: 143896234
Test: Ran newly added code to sensorservicetest and verified system
server crash doesn't occur
Change-Id: If44481de8c7fce5e01c8e1c9d90f01241d1f1cc5
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index 14ed73d..c2e1204 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -1173,6 +1173,11 @@
return nullptr;
}
int fd = resource->data[0];
+ if (!ashmem_valid(fd)) {
+ ALOGE("Supplied Ashmem memory region is invalid");
+ return nullptr;
+ }
+
int size2 = ashmem_get_size_region(fd);
// check size consistency
if (size2 < static_cast<int64_t>(size)) {