summaryrefslogtreecommitdiff
path: root/gralloc4/src/core/mali_gralloc_reference.cpp
diff options
context:
space:
mode:
authorXin Li <delphij@google.com>2024-01-17 22:14:14 -0800
committerXin Li <delphij@google.com>2024-01-17 22:14:14 -0800
commitf16b249a5e346bd673ba312f71c55f02c6d4a476 (patch)
treea508cb65119b65346d5fdef28bec836659e434b5 /gralloc4/src/core/mali_gralloc_reference.cpp
parent6734490de113dfea88f604496ffb4a149e5d0e1c (diff)
parentb0eb37f8d49caa86f61fee461addb20503914947 (diff)
downloadgchips-f16b249a5e346bd673ba312f71c55f02c6d4a476.tar.gz
Merge Android 24Q1 Release (ab/11220357)temp_319669529
Bug: 319669529 Merged-In: Ia09a914932b585ebba0b38fbfebdf75d6d9a7a76 Change-Id: I4216757468b9304fb354a44a9555b53d2e3ecb2c
Diffstat (limited to 'gralloc4/src/core/mali_gralloc_reference.cpp')
-rw-r--r--gralloc4/src/core/mali_gralloc_reference.cpp17
1 files changed, 12 insertions, 5 deletions
diff --git a/gralloc4/src/core/mali_gralloc_reference.cpp b/gralloc4/src/core/mali_gralloc_reference.cpp
index 6726895..c685c13 100644
--- a/gralloc4/src/core/mali_gralloc_reference.cpp
+++ b/gralloc4/src/core/mali_gralloc_reference.cpp
@@ -20,6 +20,7 @@
#include <android-base/thread_annotations.h>
#include <hardware/gralloc1.h>
+#include <unistd.h>
#include <algorithm>
#include <map>
@@ -62,19 +63,25 @@ private:
private_handle_t *hnd =
static_cast<private_handle_t *>(const_cast<native_handle_t *>(handle));
+ if (hnd->fd_count < 0 || hnd->fd_count > MAX_FDS) {
+ MALI_GRALLOC_LOGE("%s failed: invalid number of fds (%d)", __func__, hnd->fd_count);
+ return false;
+ }
+
int valid_fd_count = std::find(hnd->fds, hnd->fds + MAX_FDS, -1) - hnd->fds;
// One fd is reserved for metadata which is not accounted for in fd_count
- if (hnd->fd_count != valid_fd_count - 1) {
- MALI_GRALLOC_LOGE("%s failed: count of valid buffer fds does not match fd_count",
- __func__);
+ if (hnd->fd_count + 1 != valid_fd_count) {
+ MALI_GRALLOC_LOGE("%s failed: count of valid buffer fds does not match fd_count (%d != "
+ "%d)",
+ __func__, hnd->fd_count, valid_fd_count - 1);
return false;
}
auto check_pid = [&](int fd, uint64_t allocated_size) -> bool {
auto size = get_buffer_size(fd);
auto size_padding = size - (off_t)allocated_size;
- if ((size != -1) && ((size_padding < 0) || (size_padding > PAGE_SIZE))) {
- MALI_GRALLOC_LOGE("%s failed: fd (%d) size (%jd) is not within a PAGE_SIZE of "
+ if ((size != -1) && ((size_padding < 0) || (size_padding > getpagesize()))) {
+ MALI_GRALLOC_LOGE("%s failed: fd (%d) size (%jd) is not within a page of "
"expected size (%" PRIx64 ")",
__func__, fd, static_cast<intmax_t>(size), allocated_size);
return false;