commit 90ce2a9c1d3af422c66b4061805831cb208263d8
author Dan Stoza <stoza@google.com> Mon May 01 16:31:53 2017 -0700
committer Dan Stoza <stoza@google.com> Mon May 15 12:20:19 2017 -0700
tree 0c2cfc11bad7bdc0d0d8fa0cb4aad022f50937c5
parent bec844f6d4661325b3f925073876b381882d3e73

libgui: Check slot received from IGBP in Surface

Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.

Bug: 36991414
Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa

libs/gui/Surface.cpp

diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 0e2baa2..667c34a 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -222,6 +222,12 @@
         return result;
     }
 
+    if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+        ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+        android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+        return FAILED_TRANSACTION;
+    }
+
     Mutex::Autolock lock(mMutex);
 
     sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);