commit af45f0122cb96cc6d840ff624f4db2aa945022d1
author tangrobin <tangrobin@google.com> Tue Feb 26 18:10:10 2019 +0800
committer tangrobin <tangrobin@google.com> Wed Feb 27 14:57:17 2019 +0800
tree 43bff68999a46b0e66689ecace84ddc0e85f6cd9
parent 79555a7ab19277640154973573e3ca1ce1ea16b2

SF: Add defensive check on luma sampling

The Add/Remove RegionSamplingListener should return BAD_VALUE
if the input was invalid.

Bug: 119639245
Test: ./libgui_test --gtest_filter="RegionSamplingTest.*"
Change-Id: I5c5f7a30131c52dead970b23230058a62a874902

libs/gui/ISurfaceComposer.cpp

diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp
index d2f2539..f83270d 100644
--- a/libs/gui/ISurfaceComposer.cpp
+++ b/libs/gui/ISurfaceComposer.cpp
@@ -792,18 +792,18 @@
         Parcel data, reply;
         status_t error = data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
         if (error != NO_ERROR) {
-            ALOGE("addRegionSamplingListener: Failed to write interface token");
+            ALOGE("removeRegionSamplingListener: Failed to write interface token");
             return error;
         }
         error = data.writeStrongBinder(IInterface::asBinder(listener));
         if (error != NO_ERROR) {
-            ALOGE("addRegionSamplingListener: Failed to write listener");
+            ALOGE("removeRegionSamplingListener: Failed to write listener");
             return error;
         }
         error = remote()->transact(BnSurfaceComposer::REMOVE_REGION_SAMPLING_LISTENER, data,
                                    &reply);
         if (error != NO_ERROR) {
-            ALOGE("addRegionSamplingListener: Failed to transact");
+            ALOGE("removeRegionSamplingListener: Failed to transact");
         }
         return error;
     }

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index dde6cd9..8ec411f 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1309,7 +1309,7 @@
 status_t SurfaceFlinger::addRegionSamplingListener(const Rect& samplingArea,
                                                    const sp<IBinder>& stopLayerHandle,
                                                    const sp<IRegionSamplingListener>& listener) {
-    if (!listener) {
+    if (!listener || samplingArea == Rect::INVALID_RECT) {
         return BAD_VALUE;
     }
     mRegionSamplingThread->addListener(samplingArea, stopLayerHandle, listener);
@@ -1317,6 +1317,9 @@
 }
 
 status_t SurfaceFlinger::removeRegionSamplingListener(const sp<IRegionSamplingListener>& listener) {
+    if (!listener) {
+        return BAD_VALUE;
+    }
     mRegionSamplingThread->removeListener(listener);
     return NO_ERROR;
 }