commit 7cb9cd3df2332dde065faa7954ab42c2df95ef19
author Dan Stoza <stoza@google.com> Mon May 15 17:59:58 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon May 15 17:59:58 2017 +0000
tree f0fa95a56615001f3503140457b6471c98f98e5b
parent 11ab583834afc0db85b1191e91ab439f1fa9024e
parent ac93b3a30e97a441d01e8e25b33ec6840aa3f59b

libgui: Check slot received from IGBP in Surface
am: ac93b3a30e

Change-Id: I6ab9bc7f577634c0bf23359b5eb60e6dd07e4854

libs/gui/Surface.cpp

diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 27dbc4e..637527b 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -191,6 +191,13 @@
              result);
         return result;
     }
+
+    if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+        ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+        android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+        return FAILED_TRANSACTION;
+    }
+
     sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);
 
     // this should never happen