Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.
Bug:
36991414
Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
result);
return result;
}
+
+ if (buf < 0 || buf >= NUM_BUFFER_SLOTS) {
+ ALOGE("dequeueBuffer: IGraphicBufferProducer returned invalid slot number %d", buf);
+ android_errorWriteLog(0x534e4554, "36991414"); // SafetyNet logging
+ return FAILED_TRANSACTION;
+ }
+
sp<GraphicBuffer>& gbuf(mSlots[buf].buffer);
// this should never happen