commit b6fa70b9fb4e38f7e2a7013888d6c7a46102f158
author Fabien Sanglard <sanglardf@google.com> Thu Feb 02 20:20:14 2017 +0000
committer android-build-merger <android-build-merger@google.com> Thu Feb 02 20:20:14 2017 +0000
tree 3cff7ec6fc11ae8a25d0bf6942ab434c56d12748
parent d8a939213cf98aedb62da7f99667623eb3ded9e1
parent f91ee50667e8ce754b137de426d41e487aa1a2da

Fix security vulnerability am: 45b202513b am: 8778a131c2 am: 18a5e5f607
am: f91ee50667

Change-Id: I703ffd6b2a4ee5a7726bd7426f83256ad990835f

services/surfaceflinger/SurfaceFlinger_hwc1.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
index 6710bca..2d36b54 100644
--- a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
+++ b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp
@@ -2203,8 +2203,7 @@
         if (s.client != NULL) {
             sp<IBinder> binder = IInterface::asBinder(s.client);
             if (binder != NULL) {
-                String16 desc(binder->getInterfaceDescriptor());
-                if (desc == ISurfaceComposerClient::descriptor) {
+                if (binder->queryLocalInterface(ISurfaceComposerClient::descriptor) != NULL) {
                     sp<Client> client( static_cast<Client *>(s.client.get()) );
                     transactionFlags |= setClientStateLocked(client, s.state);
                 }