Validate Region.orSelf arguments
Bug: 26611248
libui.so has int overflow sanitization enable, so
validate that we have "reasonable" looking floats
before trying to orSelf the Region.
Change-Id: I135ef7be82e7abaa9aa569224c2799612847cd03
diff --git a/libs/hwui/BakedOpRenderer.cpp b/libs/hwui/BakedOpRenderer.cpp
index e65746e..a808b88 100644
--- a/libs/hwui/BakedOpRenderer.cpp
+++ b/libs/hwui/BakedOpRenderer.cpp
@@ -331,9 +331,28 @@
mRenderState.invokeFunctor(op.functor, DrawGlInfo::kModeDraw, &info);
}
+#define VALIDATE_RECT_ARG(rect, arg) \
+ ((isnanf(rect.arg) || rect.arg < -10000 || rect.arg > 10000) ? (\
+ ALOGW("suspicious " #rect "." #arg "! %f", rect.arg),\
+ false) : true)
+
+#define VALIDATE_RECT(rect) \
+ VALIDATE_RECT_ARG(rect, bottom) & \
+ VALIDATE_RECT_ARG(rect, left) & \
+ VALIDATE_RECT_ARG(rect, top) & \
+ VALIDATE_RECT_ARG(rect, right)
+
void BakedOpRenderer::dirtyRenderTarget(const Rect& uiDirty) {
if (mRenderTarget.offscreenBuffer) {
- android::Rect dirty(uiDirty.left, uiDirty.top, uiDirty.right, uiDirty.bottom);
+ bool valid = VALIDATE_RECT(uiDirty);
+ android::Rect dirty;
+ if (valid) {
+ dirty = android::Rect(uiDirty.left, uiDirty.top, uiDirty.right, uiDirty.bottom);
+ } else {
+ dirty = android::Rect(0, 0,
+ mRenderTarget.offscreenBuffer->viewportWidth,
+ mRenderTarget.offscreenBuffer->viewportHeight);
+ }
mRenderTarget.offscreenBuffer->region.orSelf(dirty);
}
}