diff options
author | Dan Austin | 2015-09-22 16:28:07 -0500 |
---|---|---|
committer | Dan Austin | 2015-09-22 19:30:39 -0500 |
commit | 1faef80170b71ee4162dc910bfe1aea9d7181e58 (patch) | |
tree | 43a11e69d69a2a6fbbdb499d398d1aead129e838 /libs | |
parent | 251c8b3ff842363243c8eea25b369bd805af7aad (diff) | |
download | frameworks-native-1faef80170b71ee4162dc910bfe1aea9d7181e58.tar.gz frameworks-native-1faef80170b71ee4162dc910bfe1aea9d7181e58.tar.xz frameworks-native-1faef80170b71ee4162dc910bfe1aea9d7181e58.zip |
Eliminate multiple benign overflow conditions.
In InputTransport.cpp, there are multiple loops in which loop
termination occurs when the value becomes zero. These termination
conditions are all written value-- > 0, which, since value is
unsigned, result in an unsigned integer overflow when value is 0.
These loops were refactored to eliminate these conditions.
Bug: 24171356
Change-Id: Ie135c4306d1f2cef2778e295242305ed5139221a
Diffstat (limited to 'libs')
-rw-r--r-- | libs/input/InputTransport.cpp | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/libs/input/InputTransport.cpp b/libs/input/InputTransport.cpp index 090ee530d..92b28d949 100644 --- a/libs/input/InputTransport.cpp +++ b/libs/input/InputTransport.cpp | |||
@@ -510,7 +510,8 @@ status_t InputConsumer::consume(InputEventFactoryInterface* factory, | |||
510 | status_t InputConsumer::consumeBatch(InputEventFactoryInterface* factory, | 510 | status_t InputConsumer::consumeBatch(InputEventFactoryInterface* factory, |
511 | nsecs_t frameTime, uint32_t* outSeq, InputEvent** outEvent) { | 511 | nsecs_t frameTime, uint32_t* outSeq, InputEvent** outEvent) { |
512 | status_t result; | 512 | status_t result; |
513 | for (size_t i = mBatches.size(); i-- > 0; ) { | 513 | for (size_t i = mBatches.size(); i > 0; ) { |
514 | i--; | ||
514 | Batch& batch = mBatches.editItemAt(i); | 515 | Batch& batch = mBatches.editItemAt(i); |
515 | if (frameTime < 0) { | 516 | if (frameTime < 0) { |
516 | result = consumeSamples(factory, batch, batch.samples.size(), | 517 | result = consumeSamples(factory, batch, batch.samples.size(), |
@@ -815,7 +816,8 @@ status_t InputConsumer::sendFinishedSignal(uint32_t seq, bool handled) { | |||
815 | uint32_t currentSeq = seq; | 816 | uint32_t currentSeq = seq; |
816 | uint32_t chainSeqs[seqChainCount]; | 817 | uint32_t chainSeqs[seqChainCount]; |
817 | size_t chainIndex = 0; | 818 | size_t chainIndex = 0; |
818 | for (size_t i = seqChainCount; i-- > 0; ) { | 819 | for (size_t i = seqChainCount; i > 0; ) { |
820 | i--; | ||
819 | const SeqChain& seqChain = mSeqChains.itemAt(i); | 821 | const SeqChain& seqChain = mSeqChains.itemAt(i); |
820 | if (seqChain.seq == currentSeq) { | 822 | if (seqChain.seq == currentSeq) { |
821 | currentSeq = seqChain.chain; | 823 | currentSeq = seqChain.chain; |
@@ -824,7 +826,8 @@ status_t InputConsumer::sendFinishedSignal(uint32_t seq, bool handled) { | |||
824 | } | 826 | } |
825 | } | 827 | } |
826 | status_t status = OK; | 828 | status_t status = OK; |
827 | while (!status && chainIndex-- > 0) { | 829 | while (!status && chainIndex > 0) { |
830 | chainIndex--; | ||
828 | status = sendUnchainedFinishedSignal(chainSeqs[chainIndex], handled); | 831 | status = sendUnchainedFinishedSignal(chainSeqs[chainIndex], handled); |
829 | } | 832 | } |
830 | if (status) { | 833 | if (status) { |
@@ -834,7 +837,10 @@ status_t InputConsumer::sendFinishedSignal(uint32_t seq, bool handled) { | |||
834 | seqChain.seq = chainIndex != 0 ? chainSeqs[chainIndex - 1] : seq; | 837 | seqChain.seq = chainIndex != 0 ? chainSeqs[chainIndex - 1] : seq; |
835 | seqChain.chain = chainSeqs[chainIndex]; | 838 | seqChain.chain = chainSeqs[chainIndex]; |
836 | mSeqChains.push(seqChain); | 839 | mSeqChains.push(seqChain); |
837 | } while (chainIndex-- > 0); | 840 | if (chainIndex != 0) { |
841 | chainIndex--; | ||
842 | } | ||
843 | } while (chainIndex > 0); | ||
838 | return status; | 844 | return status; |
839 | } | 845 | } |
840 | } | 846 | } |