From c384b1863768d424116c1bcc7f26f5764c35c330 Mon Sep 17 00:00:00 2001 From: Nick Vaccaro Date: Tue, 10 Jun 2014 18:33:07 -0700 Subject: [PATCH] Don't pass up bad sensor event packets to Sensor Services If an event packet is read containing an unknown sensor handle, don't pass it on to Sensor Services. Drop it on the floor instead as it's causing Sensor Services to crash. Moved read of queue size in sensors_poll_context_t::poll() to post queue mutex grab for safety. Bug: 15285345 Change-Id: I2ebc0f8591a1ae60f09bf9599b8321c5a3dfae69 --- modules/sensors/multihal.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp index 5fd500a..76ec161 100644 --- a/modules/sensors/multihal.cpp +++ b/modules/sensors/multihal.cpp @@ -299,10 +299,11 @@ void sensors_poll_context_t::copy_event_remap_handle(sensors_event_t* dest, sens int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) { ALOGV("poll"); int empties = 0; - int queueCount = (int)this->queues.size(); + int queueCount = 0; int eventsRead = 0; pthread_mutex_lock(&queue_mutex); + queueCount = (int)this->queues.size(); while (eventsRead == 0) { while (empties < queueCount && eventsRead < maxReads) { SensorEventQueue* queue = this->queues.at(this->nextReadIndex); @@ -311,7 +312,13 @@ int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) { empties++; } else { empties = 0; - this->copy_event_remap_handle(&data[eventsRead++], event, nextReadIndex); + this->copy_event_remap_handle(&data[eventsRead], event, nextReadIndex); + if (data[eventsRead].sensor == -1) { + // Bad handle, do not pass corrupted event upstream ! + ALOGW("Dropping bad local handle event packet on the floor"); + } else { + eventsRead++; + } queue->dequeue(); } this->nextReadIndex = (this->nextReadIndex + 1) % queueCount; -- 2.11.0