commit ccd9d51bc1551df02498dc759deee5bda8376ccb
author Harry Cutts <hcutts@google.com> Tue Sep 17 16:33:27 2024 +0000
committer Harry Cutts <hcutts@google.com> Wed Sep 18 09:43:46 2024 +0000
tree 15f8466162fae2852991c495e0274537d3da88f3
parent 751553432cfca58381be7b7a7b39561d2c920b0e

TestEventMatchers: bounds check pointer indexes

b/365166534 was caused by a WithPointer… matcher not checking that its
pointer index was in bounds, and this check is missing from a couple of
other WithPointer… matchers. Add it, so that more bugs like this can be
found instantly in future rather than causing flaky assertions against
uninitialized memory.

Test: atest inputflinger_tests
Bug: 365166534
Flag: TEST_ONLY
Change-Id: I57d23909888749e15d4d034ddb0c091336b016d1

services/inputflinger/tests/TestEventMatchers.h

diff --git a/services/inputflinger/tests/TestEventMatchers.h b/services/inputflinger/tests/TestEventMatchers.h
index 513bd72..6fa3365 100644
--- a/services/inputflinger/tests/TestEventMatchers.h
+++ b/services/inputflinger/tests/TestEventMatchers.h
@@ -615,7 +615,12 @@
     explicit WithPointerIdMatcher(size_t index, int32_t pointerId)
           : mIndex(index), mPointerId(pointerId) {}
 
-    bool MatchAndExplain(const NotifyMotionArgs& args, std::ostream*) const {
+    bool MatchAndExplain(const NotifyMotionArgs& args, std::ostream* os) const {
+        if (mIndex >= args.pointerCoords.size()) {
+            *os << "Pointer index " << mIndex << " is out of bounds";
+            return false;
+        }
+
         return args.pointerProperties[mIndex].id == mPointerId;
     }
 
@@ -797,10 +802,14 @@
     return argToolType == toolType;
 }
 
-MATCHER_P2(WithPointerToolType, pointer, toolType,
+MATCHER_P2(WithPointerToolType, pointerIndex, toolType,
            "InputEvent with specified tool type for pointer") {
-    const auto argToolType = arg.pointerProperties[pointer].toolType;
-    *result_listener << "expected pointer " << pointer << " to have tool type "
+    if (std::cmp_greater_equal(pointerIndex, arg.getPointerCount())) {
+        *result_listener << "Pointer index " << pointerIndex << " is out of bounds";
+        return false;
+    }
+    const auto argToolType = arg.pointerProperties[pointerIndex].toolType;
+    *result_listener << "expected pointer " << pointerIndex << " to have tool type "
                      << ftl::enum_string(toolType) << ", but got " << ftl::enum_string(argToolType);
     return argToolType == toolType;
 }