From: Siarhei Vishniakou <svv@google.com>
Date: Fri, 25 Aug 2017 03:36:28 +0000 (-0700)
Subject: Ensure history has pointer id of interest.
X-Git-Tag: android-x86-8.1-r1~41^2
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=c7dc3784a3302b74b895c2e8318adc62b3a0db4d;p=android-x86%2Fframeworks-native.git

Ensure history has pointer id of interest.

When two events with different pointer id's end up
next to each other in touch history, then crash may
occur by trying to access the data associated with
the second to last pointer id by using the last event's
pointer id.

Test: monkey testing on sailfish
Command: adb shell monkey -p com.google.android.deskclock -p
com.android.calculator2 -p com.google.android.contacts -p
com.android.launcher -p com.google.android.launcher -p com.android.mms
-p com.google.android.apps.messaging -p com.android.phone -p
com.google.android.dialer -p com.android.providers.downloads.ui -p
com.android.settings -p com.google.android.calendar -p
com.google.android.GoogleCamera -p com.google.android.apps.photos -p
com.google.android.gms -p com.google.android.setupwizard -p
com.google.android.googlequicksearchbox -p
com.google.android.packageinstaller -p
com.google.android.apps.nexuslauncher -c
android.intent.category.LAUNCHER --ignore-security-exceptions
--monitor-native-crashes -s 611 -v -v -v 125000
Native tests will be added later.
Fixes: 65012433

Change-Id: I560a54d7f59a8892adfad3a54db9c436e4089343
---

diff --git a/include/input/InputTransport.h b/include/input/InputTransport.h
index 0dd15b1221..944947420e 100644
--- a/include/input/InputTransport.h
+++ b/include/input/InputTransport.h
@@ -384,6 +384,10 @@ private:
         const PointerCoords& getPointerById(uint32_t id) const {
             return pointers[idToIndex[id]];
         }
+
+        bool hasPointerId(uint32_t id) const {
+            return idBits.hasBit(id);
+        }
     };
     struct TouchState {
         int32_t deviceId;
@@ -419,6 +423,9 @@ private:
             if (historySize < 2) {
                 return false;
             }
+            if (!getHistory(0)->hasPointerId(id) || !getHistory(1)->hasPointerId(id)) {
+                return false;
+            }
             float currentX = getHistory(0)->getPointerById(id).getX();
             float currentY = getHistory(0)->getPointerById(id).getY();
             float previousX = getHistory(1)->getPointerById(id).getX();