commit 7d1149401791ef3a4dfdbfbc2af68d9d2f9c10c0
author Sally Qi <sallyqi@google.com> Mon Aug 28 21:00:21 2023 -0700
committer Sally Qi <sallyqi@google.com> Tue Aug 29 17:34:34 2023 -0700
tree fa220570a7fcb5d151e90dcf58d095a1b51b6e55
parent 127d99cc7f7b1c4000ccaaec96cacaea8e2dea38

Add binder check for getConsumerName.

Bug: 297623540
Test: builds
Change-Id: I98ea3e45dcd5b34f21ee55f9b55e5e88f923f627

libs/gui/bufferqueue/1.0/H2BGraphicBufferProducer.cpp

diff --git a/libs/gui/bufferqueue/1.0/H2BGraphicBufferProducer.cpp b/libs/gui/bufferqueue/1.0/H2BGraphicBufferProducer.cpp
index f684874..fd8ffe1 100644
--- a/libs/gui/bufferqueue/1.0/H2BGraphicBufferProducer.cpp
+++ b/libs/gui/bufferqueue/1.0/H2BGraphicBufferProducer.cpp
@@ -1172,9 +1172,12 @@
 
 String8 H2BGraphicBufferProducer::getConsumerName() const {
     String8 lName;
-    mBase->getConsumerName([&lName] (hidl_string const& name) {
-                lName = name.c_str();
-            });
+    status_t transStatus = toStatusT(
+            mBase->getConsumerName([&lName](hidl_string const& name) { lName = name.c_str(); }));
+    if (transStatus != NO_ERROR) {
+        ALOGE("getConsumerName failed to transact: %d", transStatus);
+        return String8("TransactFailed");
+    }
     return lName;
 }
 

libs/gui/bufferqueue/2.0/H2BGraphicBufferProducer.cpp

diff --git a/libs/gui/bufferqueue/2.0/H2BGraphicBufferProducer.cpp b/libs/gui/bufferqueue/2.0/H2BGraphicBufferProducer.cpp
index 2f5b73c..ae00a26 100644
--- a/libs/gui/bufferqueue/2.0/H2BGraphicBufferProducer.cpp
+++ b/libs/gui/bufferqueue/2.0/H2BGraphicBufferProducer.cpp
@@ -437,6 +437,10 @@
             [&bName](hidl_string const& name) {
                 bName = name.c_str();
             });
+    if (!transResult.isOk()) {
+        LOG(ERROR) << "getConsumerName: corrupted transaction.";
+        return String8("TransactFailed");
+    }
     return bName;
 }