commit 2a8c49eb5dd51b2e60c9a78bea00870867d91c03
author Mathias Agopian <mathias@google.com> Thu Nov 15 17:19:48 2012 -0800
committer Mathias Agopian <mathias@google.com> Thu Nov 15 17:19:48 2012 -0800
tree e6c909940f07580998c920be587c0fbcc77eb8b3
parent ee932d0ad1a16cc93b4bd9eaf9cb3cc756fb2dfc

fix an out-of-bounds memory access

in this particular case, this OOB is always harmless
(and that's why it didn't get fixed from MR1), however,
it interfers with valgrind debugging.

Change-Id: Ic977e03287e59c4b124a89146c9023bd0cb540a8

libs/gui/BufferQueue.cpp

diff --git a/libs/gui/BufferQueue.cpp b/libs/gui/BufferQueue.cpp
index 590946a..607e0bd 100644
--- a/libs/gui/BufferQueue.cpp
+++ b/libs/gui/BufferQueue.cpp
@@ -314,10 +314,12 @@
                      * the consumer may still have pending reads of the
                      * buffers in flight.
                      */
-                    bool isOlder = mSlots[i].mFrameNumber <
-                            mSlots[found].mFrameNumber;
-                    if (found < 0 || isOlder) {
-                        found = i;
+                    if (found >= 0) {
+                        bool isOlder = mSlots[i].mFrameNumber <
+                                mSlots[found].mFrameNumber;
+                        if (isOlder) {
+                            found = i;
+                        }
                     }
                 }
             }