commit 4d9a8d0e2824f426087c652121320d5ed30f8ae8
author Dan Stoza <stoza@google.com> Tue May 16 21:37:40 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue May 16 21:37:40 2017 +0000
tree 457c5fc7bdb77d35b177f03ca663f21dd49c0565
parent acbff73e732bca3cc5b486d2e8aadb15f097cec5
parent 29c221a2e530dd23d2da6cc53f44e729f8ea9098

Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am: 98e3c06010 am: 970bb51580 am: 78976cea8f am: 2fe15aa6f0 am: cce83f15e5 am: 9a44ee0742 am: 787aa48f41 am: f69675e5c2 am: d65a388e1b am: b829d2abe9 am: 79a34dd24b am: a1b1e635cc am: 0c7f6e142d
am: 29c221a2e5

Change-Id: If5f2a500feb74d2b4f8b87d357ddc0143325a944

libs/gui/Surface.cpp

diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index a6d9e66..ecf27f4 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -513,6 +513,12 @@
         return result;
     }
 
+    if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+        ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+        android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+        return FAILED_TRANSACTION;
+    }
+
     Mutex::Autolock lock(mMutex);
 
     sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);