[DO NOT MERGE] Fix crash with multifinger touch exploration
Range check index into motion event x and y before using it.
Bug: 163107812
Test: Relying on treehugger. I can't reproduce the crash, so I'm just adding checks.
Change-Id: I4ac5023ef9b5c101748b870a01a425a1365fb85c
diff --git a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
index b2b37dd..a496117 100644
--- a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
+++ b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
@@ -587,6 +587,9 @@
mSendHoverExitDelayed.cancel();
if (mGestureDetector.isMultiFingerGesturesEnabled()
&& mGestureDetector.isTwoFingerPassthroughEnabled()) {
+ if (pointerIndex < 0) {
+ return;
+ }
final float deltaX =
mReceivedPointerTracker.getReceivedPointerDownX(pointerId)
- rawEvent.getX(pointerIndex);
@@ -953,25 +956,32 @@
final float secondPtrX = event.getX(1);
final float secondPtrY = event.getY(1);
final int secondPtrId = event.getPointerId(1);
- float draggingX;
- float draggingY;
+ float draggingX = firstPtrX;
+ float draggingY = firstPtrY;
+ if (mDraggingPointerId != INVALID_POINTER_ID) {
+ // Just use the coordinates of the dragging pointer.
+ int pointerIndex = event.findPointerIndex(mDraggingPointerId);
+ if (pointerIndex >= 0) {
+ draggingX = event.getX(pointerIndex);
+ draggingY = event.getY(pointerIndex);
+ } else {
+ // We've lost track of the dragging pointer. Try to recover by invalidating it.
+ // We'll the drop into the code below to choose a new one.
+ mDraggingPointerId = INVALID_POINTER_ID;
+ }
+ }
+ // Not quite an else, since the above code can invalidate the pointer
if (mDraggingPointerId == INVALID_POINTER_ID) {
// The goal is to use the coordinates of the finger that is closest to its closest edge.
if (getDistanceToClosestEdge(firstPtrX, firstPtrY)
< getDistanceToClosestEdge(secondPtrX, secondPtrY)) {
- draggingX = firstPtrX;
- draggingY = firstPtrY;
+ // X and Y initialized to firstPtrX and Y was right
mDraggingPointerId = firstPtrId;
} else {
draggingX = secondPtrX;
draggingY = secondPtrY;
mDraggingPointerId = secondPtrId;
}
- } else {
- // Just use the coordinates of the dragging pointer.
- int pointerIndex = event.findPointerIndex(mDraggingPointerId);
- draggingX = event.getX(pointerIndex);
- draggingY = event.getY(pointerIndex);
}
event.setLocation(draggingX, draggingY);
}
