Eliminate benign overflow condition triggered upon loop termination in Input.cpp
In readFromParcel, a while loop is terminated when sampleCount = 0. The
decrement operation that was here would decrease sampleCount, an unsigned value,
below 0, triggering an unsigned integer overflow. The while loop was refactored
to eliminate this condition.
Bug: 24171356
Change-Id: I7669f54a41d11548b33e322b025431c6f6038952
diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index 69a6432..ecd2d90 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -452,7 +452,8 @@
properties.toolType = parcel->readInt32();
}
- while (sampleCount-- > 0) {
+ while (sampleCount > 0) {
+ sampleCount--;
mSampleEventTimes.push(parcel->readInt64());
for (size_t i = 0; i < pointerCount; i++) {
mSamplePointerCoords.push();