1 files changed, 10 insertions, 5 deletions
diff --git a/gralloc4/src/core/mali_gralloc_reference.cpp b/gralloc4/src/core/mali_gralloc_reference.cpp
index 359a455..c685c13 100644
--- a/gralloc4/src/core/mali_gralloc_reference.cpp
+++ b/gralloc4/src/core/mali_gralloc_reference.cpp
@@ -20,13 +20,12 @@
 
 #include <android-base/thread_annotations.h>
 #include <hardware/gralloc1.h>
+#include <unistd.h>
 
 #include <algorithm>
 #include <map>
 #include <mutex>
 
-#include <unistd.h>
-
 #include "allocator/mali_gralloc_ion.h"
 #include "mali_gralloc_buffer.h"
 
@@ -64,11 +63,17 @@ private:
         private_handle_t *hnd =
                 static_cast<private_handle_t *>(const_cast<native_handle_t *>(handle));
 
+        if (hnd->fd_count < 0 || hnd->fd_count > MAX_FDS) {
+            MALI_GRALLOC_LOGE("%s failed: invalid number of fds (%d)", __func__, hnd->fd_count);
+            return false;
+        }
+
         int valid_fd_count = std::find(hnd->fds, hnd->fds + MAX_FDS, -1) - hnd->fds;
         // One fd is reserved for metadata which is not accounted for in fd_count
-        if (hnd->fd_count != valid_fd_count - 1) {
-            MALI_GRALLOC_LOGE("%s failed: count of valid buffer fds does not match fd_count",
-                              __func__);
+        if (hnd->fd_count + 1 != valid_fd_count) {
+            MALI_GRALLOC_LOGE("%s failed: count of valid buffer fds does not match fd_count (%d != "
+                              "%d)",
+                              __func__, hnd->fd_count, valid_fd_count - 1);
             return false;
         }