Merge "Eliminate multiple benign overflow conditions."
diff --git a/include/ui/Region.h b/include/ui/Region.h
index 2a14918..e9b3a0b 100644
--- a/include/ui/Region.h
+++ b/include/ui/Region.h
@@ -130,11 +130,6 @@
// Region object.
Rect const* getArray(size_t* count) const;
- // returns a SharedBuffer as well as the number of rects.
- // ownership is transfered to the caller.
- // the caller must call SharedBuffer::release() to free the memory.
- SharedBuffer const* getSharedBuffer(size_t* count) const;
-
/* no user serviceable parts here... */
// add a rectangle to the internal list. This rectangle must
diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index 69a6432..ecd2d90 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -452,7 +452,8 @@
properties.toolType = parcel->readInt32();
}
- while (sampleCount-- > 0) {
+ while (sampleCount > 0) {
+ sampleCount--;
mSampleEventTimes.push(parcel->readInt64());
for (size_t i = 0; i < pointerCount; i++) {
mSamplePointerCoords.push();
diff --git a/libs/input/VelocityTracker.cpp b/libs/input/VelocityTracker.cpp
index 6c70c3c..7f6b157 100644
--- a/libs/input/VelocityTracker.cpp
+++ b/libs/input/VelocityTracker.cpp
@@ -46,7 +46,8 @@
static float vectorDot(const float* a, const float* b, uint32_t m) {
float r = 0;
- while (m--) {
+ while (m) {
+ m--;
r += *(a++) * *(b++);
}
return r;
@@ -54,7 +55,8 @@
static float vectorNorm(const float* a, uint32_t m) {
float r = 0;
- while (m--) {
+ while (m) {
+ m--;
float t = *(a++);
r += t * t;
}
@@ -511,7 +513,8 @@
for (uint32_t h = 0; h < m; h++) {
wy[h] = y[h] * w[h];
}
- for (uint32_t i = n; i-- != 0; ) {
+ for (uint32_t i = n; i != 0; ) {
+ i--;
outB[i] = vectorDot(&q[i][0], wy, m);
for (uint32_t j = n - 1; j > i; j--) {
outB[i] -= r[i][j] * outB[j];
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 3810da4..a3558bd 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -835,18 +835,6 @@
return begin();
}
-SharedBuffer const* Region::getSharedBuffer(size_t* count) const {
- // We can get to the SharedBuffer of a Vector<Rect> because Rect has
- // a trivial destructor.
- SharedBuffer const* sb = SharedBuffer::bufferFromData(mStorage.array());
- if (count) {
- size_t numRects = isRect() ? 1 : mStorage.size() - 1;
- count[0] = numRects;
- }
- sb->acquire();
- return sb;
-}
-
// ----------------------------------------------------------------------------
void Region::dump(String8& out, const char* what, uint32_t /* flags */) const
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index 2dad005..3208990 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -1017,12 +1017,10 @@
}
}
virtual void setVisibleRegionScreen(const Region& reg) {
- // Region::getSharedBuffer creates a reference to the underlying
- // SharedBuffer of this Region, this reference is freed
- // in onDisplayed()
hwc_region_t& visibleRegion = getLayer()->visibleRegionScreen;
- SharedBuffer const* sb = reg.getSharedBuffer(&visibleRegion.numRects);
- visibleRegion.rects = reinterpret_cast<hwc_rect_t const *>(sb->data());
+ mVisibleRegion = reg;
+ visibleRegion.rects = reinterpret_cast<hwc_rect_t const *>(
+ mVisibleRegion.getArray(&visibleRegion.numRects));
}
virtual void setSurfaceDamage(const Region& reg) {
if (!hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_5)) {
@@ -1036,8 +1034,9 @@
surfaceDamage.rects = NULL;
return;
}
- SharedBuffer const* sb = reg.getSharedBuffer(&surfaceDamage.numRects);
- surfaceDamage.rects = reinterpret_cast<hwc_rect_t const *>(sb->data());
+ mSurfaceDamage = reg;
+ surfaceDamage.rects = reinterpret_cast<hwc_rect_t const *>(
+ mSurfaceDamage.getArray(&surfaceDamage.numRects));
}
virtual void setSidebandStream(const sp<NativeHandle>& stream) {
ALOG_ASSERT(stream->handle() != NULL);
@@ -1059,29 +1058,15 @@
}
}
virtual void onDisplayed() {
- hwc_region_t& visibleRegion = getLayer()->visibleRegionScreen;
- SharedBuffer const* sb = SharedBuffer::bufferFromData(visibleRegion.rects);
- if (sb) {
- sb->release();
- // not technically needed but safer
- visibleRegion.numRects = 0;
- visibleRegion.rects = NULL;
- }
-
getLayer()->acquireFenceFd = -1;
-
- if (!hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_5)) {
- return;
- }
-
- hwc_region_t& surfaceDamage = getLayer()->surfaceDamage;
- sb = SharedBuffer::bufferFromData(surfaceDamage.rects);
- if (sb) {
- sb->release();
- surfaceDamage.numRects = 0;
- surfaceDamage.rects = NULL;
- }
}
+
+protected:
+ // We need to hold "copies" of these for memory management purposes. The
+ // actual hwc_layer_1_t holds pointers to the memory within. Vector<>
+ // internally doesn't copy the memory unless one of the copies is modified.
+ Region mVisibleRegion;
+ Region mSurfaceDamage;
};
/*