hwc2: Validate bounds check for input parcel

CRs-Fixed: 2517976 Change-Id: Iba254b3579cd2c258c3cf80fe234a0de7d75e599
AOSP-10-CAF · Oct 22, 2019 · fdfb51f · fdfb51f
1 parent 98abd17
commit fdfb51f
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/sdm/libs/hwc/hwc_session.cpp b/sdm/libs/hwc/hwc_session.cpp
@@ -910,7 +910,7 @@ android::status_t HWCSession::HandleSetActiveDisplayConfig(const android::Parcel
   int dpy = input_parcel->readInt32();
   int error = android::BAD_VALUE;
 
-  if (dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
     return android::BAD_VALUE;
   }
 
@@ -929,7 +929,7 @@ android::status_t HWCSession::HandleGetActiveDisplayConfig(const android::Parcel
   int dpy = input_parcel->readInt32();
   int error = android::BAD_VALUE;
 
-  if (dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
     return android::BAD_VALUE;
   }
 
@@ -949,7 +949,7 @@ android::status_t HWCSession::HandleGetDisplayConfigCount(const android::Parcel
   int dpy = input_parcel->readInt32();
   int error = android::BAD_VALUE;
 
-  if (dpy > HWC_DISPLAY_VIRTUAL) {
+  if (dpy < HWC_DISPLAY_PRIMARY || dpy > HWC_DISPLAY_VIRTUAL) {
     return android::BAD_VALUE;
   }