commit 10d9ddfe37d067757b28e6d6270d3ce0ab150f9a
author Uday Kiran Pichika <pichika@codeaurora.org> Wed Feb 21 08:37:55 2018 +0530
committer Midas Chien <midaschieh@google.com> Wed Dec 04 17:54:17 2019 +0800
tree d4c2a0dab00afe7c74fc1514ba85abf3489cfbac
parent 25569094e42379946259ef5998d1c46e1b9b1e78

hwc2: Validate input parcel values for few qclient methods

Validate values read from input parcel as part of handling of
few qclient methods

CRs-Fixed: 2114346
Bug: 139417368
Test: run service_test with invalid input
Change-Id: Icf928f409a5c2ac76a73e95de58cb0ebc59d24d5

msm8998/sdm/libs/hwc2/hwc_session.cpp

diff --git a/msm8998/sdm/libs/hwc2/hwc_session.cpp b/msm8998/sdm/libs/hwc2/hwc_session.cpp
index 5c9f954..f077667 100644
--- a/msm8998/sdm/libs/hwc2/hwc_session.cpp
+++ b/msm8998/sdm/libs/hwc2/hwc_session.cpp
@@ -1055,7 +1055,7 @@
   int error = android::BAD_VALUE;
   DisplayConfigVariableInfo display_attributes;
 
-  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES || config < 0) {
     return android::BAD_VALUE;
   }
 
@@ -1251,7 +1251,7 @@
   auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32());
   auto device = static_cast<hwc2_device_t *>(this);
 
-  if (display > HWC_DISPLAY_VIRTUAL) {
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
     return -EINVAL;
   }
 
@@ -1266,7 +1266,7 @@
   auto mode = input_parcel->readInt32();
   auto device = static_cast<hwc2_device_t *>(this);
 
-  if (display > HWC_DISPLAY_VIRTUAL) {
+  if (display >= HWC_NUM_DISPLAY_TYPES) {
     return -EINVAL;
   }
 
@@ -1621,7 +1621,7 @@
   SCOPE_LOCK(locker_);
   int dpy = input_parcel->readInt32();
 
-  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy >= HWC_NUM_DISPLAY_TYPES) {
     return android::BAD_VALUE;
   }