commit e6f76cfafc3d1113f3cdd1a973f0751a536110e0
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Aug 03 16:29:49 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Aug 03 16:29:49 2020 +0000
tree 8fe3231042adeb5405f2db58a3e89220f7d2303f
parent cb53d839f8e6fcbe2e56b71d0b8d11cc85e58a41
parent 4c924bab945e7bbe269ca3eaaaa30ae8a713178d

Merge "libgui: layer_state_t::read() check null" into rvc-dev-plus-aosp am: 4c924bab94

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/12184116

Change-Id: Iabef4c2598b00645242ffe54adb8989e007215ab

libs/gui/LayerState.cpp

diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index e43446a..0281279 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -176,7 +176,12 @@
         sidebandStream = NativeHandle::create(input.readNativeHandle(), true);
     }
 
-    colorTransform = mat4(static_cast<const float*>(input.readInplace(16 * sizeof(float))));
+    const void* color_transform_data = input.readInplace(16 * sizeof(float));
+    if (color_transform_data) {
+        colorTransform = mat4(static_cast<const float*>(color_transform_data));
+    } else {
+        return BAD_VALUE;
+    }
     cornerRadius = input.readFloat();
     backgroundBlurRadius = input.readUint32();
     cachedBuffer.token = input.readStrongBinder();