commit 9bea0aaafab6225939467be8b09afc4cd53ade20
author Venkat Thogaru <vthogaru@codeaurora.org> Fri Apr 24 13:16:45 2020 +0530
committer Venkat Thogaru <vthogaru@codeaurora.org> Wed May 13 12:27:53 2020 +0530
tree 8e4ecdcf2172bcb766dda79e9a20f0c0a285ea78
parent 340e7f7cb0b2ef52552ec5aa8da189c8fd24d892

display: Fix null pointer dereference

Change-Id: I90236ee583a6862866b74f3645ff39e96673794a

services/config/src/device_impl.cpp

diff --git a/services/config/src/device_impl.cpp b/services/config/src/device_impl.cpp
index 97e8a82..c02de23 100644
--- a/services/config/src/device_impl.cpp
+++ b/services/config/src/device_impl.cpp
@@ -88,10 +88,12 @@
   std::lock_guard<std::mutex> lock(death_service_mutex_);
   auto itr = display_config_map_.find(client_handle);
   std::shared_ptr<DeviceClientContext> client = itr->second;
-  ConfigInterface *intf = client->GetDeviceConfigIntf();
-  intf_->UnRegisterClientContext(intf);
-  client.reset();
-  display_config_map_.erase(itr);
+  if (client != NULL) {
+    ConfigInterface *intf = client->GetDeviceConfigIntf();
+    intf_->UnRegisterClientContext(intf);
+    client.reset();
+    display_config_map_.erase(itr);
+  }
 }
 
 DeviceImpl::DeviceClientContext::DeviceClientContext(const sp<IDisplayConfigCallback> callback) {
@@ -322,19 +324,23 @@
 
   data_output = reinterpret_cast<int32_t *>(malloc(sizeof(int32_t) *
                 hdr_caps.supported_hdr_types.size() + 3 * sizeof(float)));
-  for (int i = 0; i < hdr_caps.supported_hdr_types.size(); i++) {
-    data_output[i] = hdr_caps.supported_hdr_types[i];
+  if (data_output != NULL) {
+    for (int i = 0; i < hdr_caps.supported_hdr_types.size(); i++) {
+      data_output[i] = hdr_caps.supported_hdr_types[i];
+    }
+    float *lum = reinterpret_cast<float *>(&data_output[hdr_caps.supported_hdr_types.size()]);
+    *lum = hdr_caps.max_luminance;
+    lum++;
+    *lum = hdr_caps.max_avg_luminance;
+    lum++;
+    *lum = hdr_caps.min_luminance;
+    output_params.setToExternal(reinterpret_cast<uint8_t*>(data_output), sizeof(int32_t) *
+                                hdr_caps.supported_hdr_types.size() + 3 * sizeof(float));
+    _hidl_cb(error, output_params, {});
   }
-  float *lum = reinterpret_cast<float *>(&data_output[hdr_caps.supported_hdr_types.size()]);
-  *lum = hdr_caps.max_luminance;
-  lum++;
-  *lum = hdr_caps.max_avg_luminance;
-  lum++;
-  *lum = hdr_caps.min_luminance;
-  output_params.setToExternal(reinterpret_cast<uint8_t*>(data_output), sizeof(int32_t) *
-                              hdr_caps.supported_hdr_types.size() + 3 * sizeof(float));
-
-  _hidl_cb(error, output_params, {});
+  else {
+    _hidl_cb(-EINVAL, {}, {});
+  }
 }
 
 void DeviceImpl::DeviceClientContext::ParseSetCameraLaunchStatus(const ByteStream &input_params,
@@ -699,6 +705,11 @@
   }
 
   std::shared_ptr<DeviceClientContext> client = itr->second;
+  if (!client) {
+    error = -EINVAL;
+    _hidl_cb(error, {}, {});
+     return Void();
+  }
   switch (op_code) {
     case kIsDisplayConnected:
       client->ParseIsDisplayConnected(input_params, _hidl_cb);