commit f29ff141db6791aa867ec9f081c9eb77f80b0440
author Manoj Kumar AVM <manojavm@codeaurora.org> Tue Nov 10 18:16:30 2015 -0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri Nov 13 19:18:55 2015 -0800
tree a8ff605a4fe6a03cdd488aaad2d5d46d3ed9c0b6
parent c91d4fe7b4374be7eb30e3d4cb0dbc1d5775f0b8

sdm: Fix buffer overflow

Fix buffer overflow in Prepare and Set methods to avoid
overwriting adjacent memory.

Change-Id: Iaf1c870ac263d20592678b9e2b9fc1e3cb4f6f20

sdm/libs/hwc/hwc_session.cpp

diff --git a/sdm/libs/hwc/hwc_session.cpp b/sdm/libs/hwc/hwc_session.cpp
index 9393b81..dbd06a7 100644
--- a/sdm/libs/hwc/hwc_session.cpp
+++ b/sdm/libs/hwc/hwc_session.cpp
@@ -232,7 +232,7 @@
                         hwc_display_contents_1_t **displays) {
   DTRACE_SCOPED();
 
-  if (!device || !displays) {
+  if (!device || !displays || num_displays > HWC_NUM_DISPLAY_TYPES) {
     return -EINVAL;
   }
 
@@ -312,7 +312,7 @@
 
   SEQUENCE_EXIT_SCOPE_LOCK(locker_);
 
-  if (!device || !displays) {
+  if (!device || !displays || num_displays > HWC_NUM_DISPLAY_TYPES) {
     return -EINVAL;
   }