commit ae33effd43a615183f089f0a216b5965e8104842
author Michael Lentine <mlentine@google.com> Fri Oct 31 11:10:13 2014 -0700
committer Dan Stoza <stoza@google.com> Fri Dec 05 20:31:09 2014 +0000
tree a4a8b22b63f8ca97a625398cdedebb93dcf2814b
parent 09b9193d10b3849e426c5370a757a0eedc65a7ff

Fix crash when user provides large values in the Parcel.

Bug: 18102648
Change-Id: Ie6a24718e586a34424238363de80f9545951514f
(cherry-picked from commit 8afa1c4ab86d724feb7716e153b7835385534590)

libs/gui/LayerState.cpp

diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index dcdcdf2..ccf8b78 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -55,8 +55,12 @@
     alpha = input.readFloat();
     flags = input.readInt32();
     mask = input.readInt32();
-    matrix = *reinterpret_cast<layer_state_t::matrix22_t const *>(
-            input.readInplace(sizeof(layer_state_t::matrix22_t)));
+    const void* matrix_data = input.readInplace(sizeof(layer_state_t::matrix22_t));
+    if (matrix_data) {
+        matrix = *reinterpret_cast<layer_state_t::matrix22_t const *>(matrix_data);
+    } else {
+        return BAD_VALUE;
+    }
     input.read(crop);
     input.read(transparentRegion);
     return NO_ERROR;