LineageOS/android_hardware_libhardware
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't pass up bad sensor event packets to Sensor Services

Browse Source 
If an event packet is read containing an unknown sensor handle,
don't pass it on to Sensor Services. Drop it on the floor instead
as it's causing Sensor Services to crash.

Moved read of queue size in sensors_poll_context_t::poll() to post
queue mutex grab for safety.

Bug: 15285345
Change-Id: I2ebc0f8591a1ae60f09bf9599b8321c5a3dfae69
This commit is contained in:
Nick Vaccaro
2014-06-10 18:33:07 -07:00
parent ef2c616c4e
commit c384b18637
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
modules/sensors/multihal.cpp
View File

@@ -299,10 +299,11 @@ void sensors_poll_context_t::copy_event_remap_handle(sensors_event_t* dest, sens
int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) { int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) {
ALOGV("poll"); ALOGV("poll");
int empties = 0; int empties = 0;
int queueCount = (int)this->queues.size(); int queueCount = 0;
int eventsRead = 0; int eventsRead = 0;
pthread_mutex_lock(&queue_mutex); pthread_mutex_lock(&queue_mutex);
queueCount = (int)this->queues.size();
while (eventsRead == 0) { while (eventsRead == 0) {
while (empties < queueCount && eventsRead < maxReads) { while (empties < queueCount && eventsRead < maxReads) {
SensorEventQueue* queue = this->queues.at(this->nextReadIndex); SensorEventQueue* queue = this->queues.at(this->nextReadIndex);
@@ -311,7 +312,13 @@ int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) {
empties++; empties++;
} else { } else {
empties = 0; empties = 0;
this->copy_event_remap_handle(&data[eventsRead++], event, nextReadIndex); this->copy_event_remap_handle(&data[eventsRead], event, nextReadIndex);
if (data[eventsRead].sensor == -1) {
// Bad handle, do not pass corrupted event upstream !
ALOGW("Dropping bad local handle event packet on the floor");
} else {
eventsRead++;
}
queue->dequeue(); queue->dequeue();
} }
this->nextReadIndex = (this->nextReadIndex + 1) % queueCount; this->nextReadIndex = (this->nextReadIndex + 1) % queueCount;