commit 8f3da5ea8279339fe80dd060e378979736f73b42
author Denis Hsu <denis.hsu@mediatek.com> Wed Jul 15 09:31:21 2020 +0800
committer Robert Chou <robertchou@google.com> Mon Jul 20 05:33:58 2020 +0000
tree a726ea8e1f2f6002b04836e16c823463b86b700d
parent 3fab51ee7064bc478ebaeadf068ceb628ca2365a

libgui: layer_state_t::read() check null

layer_state_t::read() check null for color_transform

Bug: 161319576
Test: boot ok
Test: Service Fuzz
Change-Id: I0d466a9b1d2f6b57cd5f8ddce79da3d7f0a1725a

libs/gui/LayerState.cpp

diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index e43446a..0281279 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -176,7 +176,12 @@
         sidebandStream = NativeHandle::create(input.readNativeHandle(), true);
     }
 
-    colorTransform = mat4(static_cast<const float*>(input.readInplace(16 * sizeof(float))));
+    const void* color_transform_data = input.readInplace(16 * sizeof(float));
+    if (color_transform_data) {
+        colorTransform = mat4(static_cast<const float*>(color_transform_data));
+    } else {
+        return BAD_VALUE;
+    }
     cornerRadius = input.readFloat();
     backgroundBlurRadius = input.readUint32();
     cachedBuffer.token = input.readStrongBinder();