From 5d17838adef13062717322e79d4db0b9bb6b2395 Mon Sep 17 00:00:00 2001 From: Flanker Date: Mon, 7 Sep 2015 15:28:58 +0800 Subject: add number constraint for samples per MotionEvent Bug:23905002 Signed-off-by: Adam Lesinski (cherry picked from commit 552a8a5d8df32f659b8d11311a244cdc6d3b7733) Change-Id: I9b7ea859889b7697bee4165a2746602212120543 --- libs/input/Input.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'libs') diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp index 6f53996..83e241c 100644 --- a/libs/input/Input.cpp +++ b/libs/input/Input.cpp @@ -490,7 +490,8 @@ void MotionEvent::transform(const float matrix[9]) { status_t MotionEvent::readFromParcel(Parcel* parcel) { size_t pointerCount = parcel->readInt32(); size_t sampleCount = parcel->readInt32(); - if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) { + if (pointerCount == 0 || pointerCount > MAX_POINTERS || + sampleCount == 0 || sampleCount > MAX_SAMPLES) { return BAD_VALUE; } -- cgit v1.1