Use empty frame for input when layer bounds is invalid
Fixed a few issues:
1. Return INVALID_RECT for size if there's no buffer for BLAST. This was
already done in BufferQueueLayer. This ensures we don't assume the layer
has a valid size when there's no buffer
2. Don't transform invalid layer bounds in fillInputInfo since it could
result in sending a valid frame when the layer actually has no bounds.
Instead just set input frame to empty, reset the transform, and return
early.
Test: Window with no width or height doesn't get untrusted touch
Test: InputSurfacesTest
Fixes: 173297887
Change-Id: I191d411b0f83ce57b6fdc20a1def8070110d418b
diff --git a/services/surfaceflinger/BufferStateLayer.cpp b/services/surfaceflinger/BufferStateLayer.cpp
index 5cf0460..b6c59cd 100644
--- a/services/surfaceflinger/BufferStateLayer.cpp
+++ b/services/surfaceflinger/BufferStateLayer.cpp
@@ -479,6 +479,10 @@
return Rect(getActiveWidth(s), getActiveHeight(s));
}
+ if (mBufferInfo.mBuffer == nullptr) {
+ return Rect::INVALID_RECT;
+ }
+
// if the display frame is not defined, use the parent bounds as the buffer size.
const auto& p = mDrawingParent.promote();
if (p != nullptr) {