commit e661f9677d184fae6163116c7c79b8edfa87284d
author Ramkumar Radhakrishnan <ramkumar@codeaurora.org> Wed Jun 05 17:21:38 2013 -0700
committer Ramkumar Radhakrishnan <ramkumar@codeaurora.org> Wed Jun 05 18:41:47 2013 -0700
tree b9e9af18a4d8340c47a8640a7b92ffcad160b593
parent 5153b5836d3baff19b328d2881ce8eb9e8783fe7

hwc: Fix to avoid heap corruption

- Check for MAX_NUM_APP_LAYERS before updating yuv indices array.
- Fall back to GPU composition when number of app layers exceeds
  MAX_NUM_APP_LAYERS to avoid heap corruption.

Change-Id: Ieb91b705a0a5f50ce2f8829d1f1ee048d44b7d2e

libhwcomposer/hwc_mdpcomp.h

diff --git a/libhwcomposer/hwc_mdpcomp.h b/libhwcomposer/hwc_mdpcomp.h
index a0255b7..e2800d2 100644
--- a/libhwcomposer/hwc_mdpcomp.h
+++ b/libhwcomposer/hwc_mdpcomp.h
@@ -78,7 +78,7 @@
     struct FrameInfo {
         /* maps layer list to mdp list */
         int layerCount;
-        int layerToMDP[MAX_NUM_LAYERS];
+        int layerToMDP[MAX_NUM_APP_LAYERS];
 
         /* maps mdp list to layer list */
         int mdpCount;
@@ -86,7 +86,7 @@
 
         /* layer composing on FB? */
         int fbCount;
-        bool isFBComposed[MAX_NUM_LAYERS];
+        bool isFBComposed[MAX_NUM_APP_LAYERS];
 
         bool needsRedraw;
         int fbZ;
@@ -104,7 +104,7 @@
         int mdpCount;
         int cacheCount;
         int fbZ;
-        buffer_handle_t hnd[MAX_NUM_LAYERS];
+        buffer_handle_t hnd[MAX_NUM_APP_LAYERS];
 
         /* c'tor */
         LayerCache();