commit 552a8a5d8df32f659b8d11311a244cdc6d3b7733
author Flanker <i@flanker017.me> Mon Sep 07 15:28:58 2015 +0800
committer Adam Lesinski <adamlesinski@google.com> Mon Oct 12 11:22:37 2015 -0700
tree 88db9e790399c7f18624f75974c99e90f3e04e38
parent b0127aadafbf3b314475e48772fdcc17939c5a9c

add number constraint for samples per MotionEvent

Bug:23905002
Change-Id: Ifd24802977c3dcdd1dbc5120a78aac41beae4603

Signed-off-by: Adam Lesinski <adamlesinski@google.com>

libs/input/Input.cpp

diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index 2c1418e..b64cb2c 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -424,7 +424,8 @@
 status_t MotionEvent::readFromParcel(Parcel* parcel) {
     size_t pointerCount = parcel->readInt32();
     size_t sampleCount = parcel->readInt32();
-    if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) {
+    if (pointerCount == 0 || pointerCount > MAX_POINTERS ||
+            sampleCount == 0 || sampleCount > MAX_SAMPLES) {
         return BAD_VALUE;
     }