| commit | eb96d75ccffefaf66586d3e20814a3dd40f41a97 | [log] [tgz] |
|---|---|---|
| author | Ram Indani <ramindani@google.com> | Tue May 30 17:52:15 2023 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Tue May 30 17:52:15 2023 +0000 |
| tree | 138c9c6ad64463433782f552914ecc97420e6496 | |
| parent | 6190d1a04a87b59464a5fa78c6164230507b8115 [diff] | |
| parent | 5314ce4cfae876410ee8fd9d990a2848afba3a8b [diff] |
Merge "[VTS 2.3] Add length check before reading blob" into udc-dev am: a9d135cd14 am: 5314ce4cfa Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/23438943 Change-Id: Ie6b60f5ebbcd2c7e7a026dde6ff0b20095f5a2d1 Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h index f1d61f8..42996dd 100644 --- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h +++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -82,7 +82,7 @@ std::vector<IComposerClient::PerFrameMetadataBlob> metadata; - for (size_t i = 0; i < numBlobs; i++) { + for (size_t i = 0; i < numBlobs && length >= 2; i++) { IComposerClient::PerFrameMetadataKey key = static_cast<IComposerClient::PerFrameMetadataKey>(readSigned()); uint32_t blobSize = read();