SurfaceFlinger: Add NULL check for buffer handling

[android-x86/frameworks-native.git] / libs / gui / IGraphicBufferProducer.cpp

diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 48b2870..6b38811 100644 (file)
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -41,7 +41,6 @@ enum {
     DISCONNECT,
 };
 
-
 class BpGraphicBufferProducer : public BpInterface<IGraphicBufferProducer>
 {
 public:
@@ -94,13 +93,10 @@ public:
             return result;
         }
         *buf = reply.readInt32();
-        bool fenceWasWritten = reply.readInt32();
-        if (fenceWasWritten) {
-            // If the fence was written by the callee, then overwrite the
-            // caller's fence here.  If it wasn't written then don't touch the
-            // caller's fence.
+        bool nonNull = reply.readInt32();
+        if (nonNull) {
             *fence = new Fence();
-            reply.read(*(fence->get()));
+            reply.read(**fence);
         }
         result = reply.readInt32();
         return result;
@@ -116,7 +112,12 @@ public:
         if (result != NO_ERROR) {
             return result;
         }
-        memcpy(output, reply.readInplace(sizeof(*output)), sizeof(*output));
+        const void *out_data =reply.readInplace(sizeof(*output));
+        if(out_data != NULL) {
+            memcpy(output, out_data, sizeof(*output));
+        } else {
+            return BAD_VALUE;
+        }
         result = reply.readInt32();
         return result;
     }
@@ -142,16 +143,23 @@ public:
         return result;
     }
 
-    virtual status_t connect(int api, bool producerControlledByApp, QueueBufferOutput* output) {
+    virtual status_t connect(const sp<IBinder>& token,
+            int api, bool producerControlledByApp, QueueBufferOutput* output) {
         Parcel data, reply;
         data.writeInterfaceToken(IGraphicBufferProducer::getInterfaceDescriptor());
+        data.writeStrongBinder(token);
         data.writeInt32(api);
         data.writeInt32(producerControlledByApp);
         status_t result = remote()->transact(CONNECT, data, &reply);
         if (result != NO_ERROR) {
             return result;
         }
-        memcpy(output, reply.readInplace(sizeof(*output)), sizeof(*output));
+        const void *out_data =reply.readInplace(sizeof(*output));
+        if(out_data != NULL) {
+            memcpy(output, out_data, sizeof(*output));
+        } else {
+            return BAD_VALUE;
+        }
         result = reply.readInt32();
         return result;
     }
@@ -209,7 +217,7 @@ status_t BnGraphicBufferProducer::onTransact(
             reply->writeInt32(buf);
             reply->writeInt32(fence != NULL);
             if (fence != NULL) {
-                reply->write(*fence.get());
+                reply->write(*fence);
             }
             reply->writeInt32(result);
             return NO_ERROR;
@@ -244,12 +252,13 @@ status_t BnGraphicBufferProducer::onTransact(
         } break;
         case CONNECT: {
             CHECK_INTERFACE(IGraphicBufferProducer, data, reply);
+            sp<IBinder> token = data.readStrongBinder();
             int api = data.readInt32();
             bool producerControlledByApp = data.readInt32();
             QueueBufferOutput* const output =
                     reinterpret_cast<QueueBufferOutput *>(
                             reply->writeInplace(sizeof(QueueBufferOutput)));
-            status_t res = connect(api, producerControlledByApp, output);
+            status_t res = connect(token, api, producerControlledByApp, output);
             reply->writeInt32(res);
             return NO_ERROR;
         } break;
@@ -272,6 +281,7 @@ IGraphicBufferProducer::QueueBufferInput::QueueBufferInput(const Parcel& parcel)
 
 size_t IGraphicBufferProducer::QueueBufferInput::getFlattenedSize() const {
     return sizeof(timestamp)
+         + sizeof(isAutoTimestamp)
          + sizeof(crop)
          + sizeof(scalingMode)
          + sizeof(transform)
@@ -290,6 +300,7 @@ status_t IGraphicBufferProducer::QueueBufferInput::flatten(
         return NO_MEMORY;
     }
     FlattenableUtils::write(buffer, size, timestamp);
+    FlattenableUtils::write(buffer, size, isAutoTimestamp);
     FlattenableUtils::write(buffer, size, crop);
     FlattenableUtils::write(buffer, size, scalingMode);
     FlattenableUtils::write(buffer, size, transform);
@@ -302,6 +313,7 @@ status_t IGraphicBufferProducer::QueueBufferInput::unflatten(
 {
     size_t minNeeded =
               sizeof(timestamp)
+            + sizeof(isAutoTimestamp)
             + sizeof(crop)
             + sizeof(scalingMode)
             + sizeof(transform)
@@ -312,6 +324,7 @@ status_t IGraphicBufferProducer::QueueBufferInput::unflatten(
     }
 
     FlattenableUtils::read(buffer, size, timestamp);
+    FlattenableUtils::read(buffer, size, isAutoTimestamp);
     FlattenableUtils::read(buffer, size, crop);
     FlattenableUtils::read(buffer, size, scalingMode);
     FlattenableUtils::read(buffer, size, transform);