[sensors] Add parameter check to poll()
Check maxCount parameter so that it will not allocate overly large
amount of memory if input parameter is bad.
Bug: 32953589
Test: build and pass vts
Change-Id: Ia19e0315ab1623b8b6580889c1e058a19e6c9670
diff --git a/sensors/1.0/default/Sensors.cpp b/sensors/1.0/default/Sensors.cpp
index 8903397..e4ef99d 100644
--- a/sensors/1.0/default/Sensors.cpp
+++ b/sensors/1.0/default/Sensors.cpp
@@ -151,12 +151,13 @@
return Void();
}
- std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[maxCount]);
+ int bufferSize = maxCount <= kPollMaxBufferSize ? maxCount : kPollMaxBufferSize;
+
+ std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[bufferSize]);
int err = mSensorDevice->poll(
reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
- data.get(),
- maxCount);
+ data.get(), bufferSize);
if (err < 0) {
_hidl_cb(ResultFromStatus(err), out, dynamicSensorsAdded);
diff --git a/sensors/1.0/default/Sensors.h b/sensors/1.0/default/Sensors.h
index e8bd98d..09729d3 100644
--- a/sensors/1.0/default/Sensors.h
+++ b/sensors/1.0/default/Sensors.h
@@ -27,6 +27,7 @@
namespace V1_0 {
namespace implementation {
+
struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
Sensors();
@@ -60,6 +61,7 @@
configDirectReport_cb _hidl_cb) override;
private:
+ static constexpr int32_t kPollMaxBufferSize = 128;
status_t mInitCheck;
sensors_module_t *mSensorModule;
sensors_poll_device_1_t *mSensorDevice;