| commit | caee7cd3f678e840f808e8545614d0465f8bc963 | [log] [tgz] |
|---|---|---|
| author | ramindani <ramindani@google.com> | Thu May 25 22:07:04 2023 +0000 |
| committer | Ram Indani <ramindani@google.com> | Thu May 25 22:12:24 2023 +0000 |
| tree | a7125e0985a1b6fecf93b0efc0522b7315a6b05b | |
| parent | a3f446f54353bc2d83546dcd35415a9ddb6087be [diff] |
[VTS 2.3] Add length check before reading blob Adding a length check prevents the read() from reading outside the bounds and prevents OOB crash. Test: atest VtsHalGraphicsComposerV2_3TargetTest && atest VtsHalGraphicsComposerV2_4TargetTest BUG: 252764300 Change-Id: I6231e340a925127f9c32ccb76768286f7292df58 Merged-In: I6231e340a925127f9c32ccb76768286f7292df58
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h index f1d61f8..42996dd 100644 --- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h +++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -82,7 +82,7 @@ std::vector<IComposerClient::PerFrameMetadataBlob> metadata; - for (size_t i = 0; i < numBlobs; i++) { + for (size_t i = 0; i < numBlobs && length >= 2; i++) { IComposerClient::PerFrameMetadataKey key = static_cast<IComposerClient::PerFrameMetadataKey>(readSigned()); uint32_t blobSize = read();