commit 5bb66aea51ca2390c533057176712f14607a9de6
author Courtney Goeltzenleuchter <courtneygo@google.com> Thu May 24 08:23:55 2018 -0600
committer android-build-team Robot <android-build-team-robot@google.com> Fri Aug 10 20:28:47 2018 +0000
tree 2871a9eb9e26c9efc3036adcfbfce6b1b6e602f4
parent 9c44e92418489d1d773a3dc2406608ebba23cc13

Fix Buffer Overflow in Vendor Service display.qservice

Bug: 63145942
Test: adb shell vndservice call display.qservice 36 s16 sdlkfjsadlfkjasdf
Change-Id: I3fdf5ccd2bf4ed0fa980883fefdb57eb5fbfeee7
(cherry picked from commit 4050091844ccd427587024e5fd916113a5cc0029)

msm8996/sdm/libs/hwc2/hwc_session.cpp

diff --git a/msm8996/sdm/libs/hwc2/hwc_session.cpp b/msm8996/sdm/libs/hwc2/hwc_session.cpp
index d12d758..a0ff525 100644
--- a/msm8996/sdm/libs/hwc2/hwc_session.cpp
+++ b/msm8996/sdm/libs/hwc2/hwc_session.cpp
@@ -1221,6 +1221,11 @@
   auto display = static_cast<hwc2_display_t >(input_parcel->readInt32());
   auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32());
   auto device = static_cast<hwc2_device_t *>(this);
+
+  if (display > HWC_DISPLAY_VIRTUAL) {
+    return -EINVAL;
+  }
+
   auto err = CallDisplayFunction(device, display, &HWCDisplay::SetColorMode, mode);
   if (err != HWC2_ERROR_NONE)
     return -EINVAL;

msm8998/sdm/libs/hwc2/hwc_session.cpp

diff --git a/msm8998/sdm/libs/hwc2/hwc_session.cpp b/msm8998/sdm/libs/hwc2/hwc_session.cpp
index a9c7e4e..d58ce0f 100644
--- a/msm8998/sdm/libs/hwc2/hwc_session.cpp
+++ b/msm8998/sdm/libs/hwc2/hwc_session.cpp
@@ -1250,6 +1250,11 @@
   auto display = static_cast<hwc2_display_t >(input_parcel->readInt32());
   auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32());
   auto device = static_cast<hwc2_device_t *>(this);
+
+  if (display > HWC_DISPLAY_VIRTUAL) {
+    return -EINVAL;
+  }
+
   auto err = CallDisplayFunction(device, display, &HWCDisplay::SetColorMode, mode);
   if (err != HWC2_ERROR_NONE)
     return -EINVAL;