| commit | a9d135cd143af40c07b5afe5bb2d57685de3df73 | [log] [tgz] |
|---|---|---|
| author | Ram Indani <ramindani@google.com> | Tue May 30 16:24:09 2023 +0000 |
| committer | Android (Google) Code Review <android-gerrit@google.com> | Tue May 30 16:24:09 2023 +0000 |
| tree | 32202333de188048d9db5a905b24ebc763b68f9a | |
| parent | 0638c509946fc3eafcc77d0a976804db8788b948 [diff] | |
| parent | caee7cd3f678e840f808e8545614d0465f8bc963 [diff] |
Merge "[VTS 2.3] Add length check before reading blob" into udc-dev
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h index f1d61f8..42996dd 100644 --- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h +++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -82,7 +82,7 @@ std::vector<IComposerClient::PerFrameMetadataBlob> metadata; - for (size_t i = 0; i < numBlobs; i++) { + for (size_t i = 0; i < numBlobs && length >= 2; i++) { IComposerClient::PerFrameMetadataKey key = static_cast<IComposerClient::PerFrameMetadataKey>(readSigned()); uint32_t blobSize = read();