diff options
| author | Robin Peng <robinpeng@google.com> | 2019-02-14 08:15:20 +0800 |
|---|---|---|
| committer | Robin Peng <robinpeng@google.com> | 2019-02-14 08:18:03 +0800 |
| commit | 60c6ca0f32ad76d6ea92ef29374fa09aa968de30 (patch) | |
| tree | 49933e5ec3d833f329dd35ab8de11f4c9a60f722 /gralloc | |
| parent | 07600fa7c70c73de212b21c202b4a93e3f9b2522 (diff) | |
| parent | 812b746443fded8007cfe9b021076797e6a0a66f (diff) | |
| download | display-60c6ca0f32ad76d6ea92ef29374fa09aa968de30.tar.gz | |
Merge remote-tracking branch 'goog/qcom/release/LA.UM.7.8.9.C1.08.00.00.516.083'
Bug: 124397977
Change-Id: Ief65f25b171c30157b200ee67209055a4003a635
Diffstat (limited to 'gralloc')
| -rw-r--r-- | gralloc/gr_buf_mgr.cpp | 4 | ||||
| -rw-r--r-- | gralloc/gr_priv_handle.h | 12 |
2 files changed, 11 insertions, 5 deletions
diff --git a/gralloc/gr_buf_mgr.cpp b/gralloc/gr_buf_mgr.cpp index 985dd3ef..48675ad3 100644 --- a/gralloc/gr_buf_mgr.cpp +++ b/gralloc/gr_buf_mgr.cpp @@ -101,6 +101,10 @@ void BufferManager::RegisterHandleLocked(const private_handle_t *hnd, int ion_ha } Error BufferManager::ImportHandleLocked(private_handle_t *hnd) { + if (private_handle_t::validate(hnd) != 0) { + ALOGE("ImportHandleLocked: Invalid handle: %p", hnd); + return Error::BAD_BUFFER; + } ALOGD_IF(DEBUG, "Importing handle:%p id: %" PRIu64, hnd, hnd->id); int ion_handle = allocator_->ImportBuffer(hnd->fd); if (ion_handle < 0) { diff --git a/gralloc/gr_priv_handle.h b/gralloc/gr_priv_handle.h index 752a8774..cbfc8676 100644 --- a/gralloc/gr_priv_handle.h +++ b/gralloc/gr_priv_handle.h @@ -132,12 +132,14 @@ struct private_handle_t : public native_handle_t { static int validate(const native_handle *h) { auto *hnd = static_cast<const private_handle_t *>(h); if (!h || h->version != sizeof(native_handle) || h->numInts != NumInts() || - h->numFds != kNumFds || hnd->magic != kMagic) { - ALOGE( - "Invalid gralloc handle (at %p): ver(%d/%zu) ints(%d/%d) fds(%d/%d) " - "magic(%c%c%c%c/%c%c%c%c)", + h->numFds != kNumFds) { + ALOGE("Invalid gralloc handle (at %p): ver(%d/%zu) ints(%d/%d) fds(%d/%d) ", h, h ? h->version : -1, sizeof(native_handle), h ? h->numInts : -1, NumInts(), - h ? h->numFds : -1, kNumFds, + h ? h->numFds : -1, kNumFds); + return -EINVAL; + } + if (hnd->magic != kMagic) { + ALOGE("magic(%c%c%c%c/%c%c%c%c)", hnd ? (((hnd->magic >> 24) & 0xFF) ? ((hnd->magic >> 24) & 0xFF) : '-') : '?', hnd ? (((hnd->magic >> 16) & 0xFF) ? ((hnd->magic >> 16) & 0xFF) : '-') : '?', hnd ? (((hnd->magic >> 8) & 0xFF) ? ((hnd->magic >> 8) & 0xFF) : '-') : '?', |