Explorar el Código

sm8450-common: udfps: Don't try to read with a negative length

Change-Id: If404b671eff00ac8281af2038a113519cd10cc9d
Arian hace 1 año
padre
commit
573195b6d2
Se han modificado 1 ficheros con 6 adiciones y 0 borrados
  1. 6 0
      udfps/UdfpsHandler.cpp

+ 6 - 0
udfps/UdfpsHandler.cpp

@@ -77,7 +77,13 @@ static disp_event_resp* parseDispEvent(int fd) {
     struct disp_event_resp* response =
             reinterpret_cast<struct disp_event_resp*>(malloc(header.length));
     response->base = header;
+
     int dataLength = response->base.length - sizeof(response->base);
+    if (dataLength < 0) {
+        LOG(ERROR) << "invalid data length: " << response->base.length;
+        return nullptr;
+    }
+
     ssize_t dataSize = read(fd, &response->data, dataLength);
     if (dataSize < dataLength) {
         LOG(ERROR) << "unexpected display event data size: " << dataSize;