commit e267dc89414eedd8f4dee067b8a557129f1f76db
author Ady Abraham <adyabr@google.com> Mon Jul 27 16:17:07 2020 -0700
committer Ady Abraham <adyabr@google.com> Mon Jul 27 23:17:45 2020 +0000
tree 484b62f25538bc8248a3c063de8b3807a2c38396
parent 60a04cae26687f12069f7b178a3036c828edd418

SF: add boundary check for active config

Make sure that the config specific in backdoor is valid before
calling setActiveConfig.

Bug: 162057236
Test: adb shell service call SurfaceFlinger 1035 i32 100
Change-Id: Icc6e47872cb558e638b54c16779cff6dacdc063f

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 3b562bf..89ad4ae 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -5323,7 +5323,8 @@
             case 1035: {
                 n = data.readInt32();
                 mDebugDisplayConfigSetByBackdoor = false;
-                if (n >= 0) {
+                const auto numConfigs = mRefreshRateConfigs->getAllRefreshRates().size();
+                if (n >= 0 && n < numConfigs) {
                     const auto displayToken = getInternalDisplayToken();
                     status_t result = setActiveConfig(displayToken, n);
                     if (result != NO_ERROR) {