diff options
| author | Courtney Goeltzenleuchter <courtneygo@google.com> | 2018-05-24 08:23:55 -0600 |
|---|---|---|
| committer | Courtney Goeltzenleuchter <courtneygo@google.com> | 2018-05-24 08:23:55 -0600 |
| commit | 4050091844ccd427587024e5fd916113a5cc0029 (patch) | |
| tree | b754cca3f95c089b47de4221a754b3c702f5712d /msm8998 | |
| parent | 37d3c4fab01de0a94a6b1c0e01799c2cd17c1c6b (diff) | |
| download | display-4050091844ccd427587024e5fd916113a5cc0029.tar.gz | |
Fix Buffer Overflow in Vendor Service display.qservice
Bug: 63145942
Test: adb shell vndservice call display.qservice 36 s16 sdlkfjsadlfkjasdf
Change-Id: I3fdf5ccd2bf4ed0fa980883fefdb57eb5fbfeee7
Diffstat (limited to 'msm8998')
| -rw-r--r-- | msm8998/sdm/libs/hwc2/hwc_session.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/msm8998/sdm/libs/hwc2/hwc_session.cpp b/msm8998/sdm/libs/hwc2/hwc_session.cpp index a9c7e4e2..d58ce0f9 100644 --- a/msm8998/sdm/libs/hwc2/hwc_session.cpp +++ b/msm8998/sdm/libs/hwc2/hwc_session.cpp @@ -1250,6 +1250,11 @@ android::status_t HWCSession::SetColorModeOverride(const android::Parcel *input_ auto display = static_cast<hwc2_display_t >(input_parcel->readInt32()); auto mode = static_cast<android_color_mode_t>(input_parcel->readInt32()); auto device = static_cast<hwc2_device_t *>(this); + + if (display > HWC_DISPLAY_VIRTUAL) { + return -EINVAL; + } + auto err = CallDisplayFunction(device, display, &HWCDisplay::SetColorMode, mode); if (err != HWC2_ERROR_NONE) return -EINVAL; |