| commit | 5005cf3446e101f6af71e56a82768a95e65c4a6f | [log] [tgz] |
|---|---|---|
| author | Ram Indani <ramindani@google.com> | Tue May 30 17:08:23 2023 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue May 30 17:08:23 2023 +0000 |
| tree | 32202333de188048d9db5a905b24ebc763b68f9a | |
| parent | 958347cf83b0d410e84707541c6548a50637b6a9 [diff] | |
| parent | a9d135cd143af40c07b5afe5bb2d57685de3df73 [diff] |
Merge "[VTS 2.3] Add length check before reading blob" into udc-dev am: a9d135cd14 Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/23438943 Change-Id: I96e3b386057338fef3255667003f71387bd38a9f Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h index f1d61f8..42996dd 100644 --- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h +++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -82,7 +82,7 @@ std::vector<IComposerClient::PerFrameMetadataBlob> metadata; - for (size_t i = 0; i < numBlobs; i++) { + for (size_t i = 0; i < numBlobs && length >= 2; i++) { IComposerClient::PerFrameMetadataKey key = static_cast<IComposerClient::PerFrameMetadataKey>(readSigned()); uint32_t blobSize = read();