commit f2320abad7787cf57830bf6ace932954c107f176
author Siarhei Vishniakou <svv@google.com> Mon Feb 11 12:37:09 2019 -0800
committer Siarhei Vishniakou <svv@google.com> Mon Feb 11 12:40:44 2019 -0800
tree 0a26e6ce25d49828c795f7d5e5a847acfe78bae5
parent a028c449a64a98b62a0553418fd817ec1392e6cc

Fix use after free in InputClassifier

Do not send address of a variable outside of the scope of the variable.

Test: presubmit
Bug: 124232816
Change-Id: I18b4e27ef333f3a8354bdeba89ea2a912106cdaa

services/inputflinger/InputClassifier.cpp

diff --git a/services/inputflinger/InputClassifier.cpp b/services/inputflinger/InputClassifier.cpp
index 09a004c..3905ed0 100644
--- a/services/inputflinger/InputClassifier.cpp
+++ b/services/inputflinger/InputClassifier.cpp
@@ -705,13 +705,12 @@
 }
 
 void InputClassifier::notifyMotion(const NotifyMotionArgs* args) {
+    NotifyMotionArgs copyArgs = NotifyMotionArgs(*args);
     if (mMotionClassifier && isTouchEvent(*args)) {
         // We only cover touch events, for now.
-        NotifyMotionArgs newArgs = NotifyMotionArgs(*args);
-        newArgs.classification = mMotionClassifier->classify(newArgs);
-        args = &newArgs;
+        copyArgs.classification = mMotionClassifier->classify(copyArgs);
     }
-    mListener->notifyMotion(args);
+    mListener->notifyMotion(&copyArgs);
 }
 
 void InputClassifier::notifySwitch(const NotifySwitchArgs* args) {