diff options
author | Mathias Agopian <mathias@google.com> | 2012-05-29 19:46:14 -0700 |
---|---|---|
committer | Mathias Agopian <mathias@google.com> | 2012-06-27 17:07:56 -0700 |
commit | d1920ffede9e9bc107104ad94c291ca0f0f18bc3 (patch) | |
tree | 103cccf1e60b97d2585b074a06b2969101a0fb84 /services/sensorservice/SensorService.cpp | |
parent | a5c106a4f0afcf061728a1cb7c8c3b908728575d (diff) | |
download | frameworks_native-d1920ffede9e9bc107104ad94c291ca0f0f18bc3.zip frameworks_native-d1920ffede9e9bc107104ad94c291ca0f0f18bc3.tar.gz frameworks_native-d1920ffede9e9bc107104ad94c291ca0f0f18bc3.tar.bz2 |
Fix a stack corruption in sensorservice
Bug: 6576732
Change-Id: If0f2fb0d0c35b932fb77cd262e676042145b28f9
Diffstat (limited to 'services/sensorservice/SensorService.cpp')
-rw-r--r-- | services/sensorservice/SensorService.cpp | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp index d3b667f..04ec820 100644 --- a/services/sensorservice/SensorService.cpp +++ b/services/sensorservice/SensorService.cpp @@ -225,9 +225,10 @@ bool SensorService::threadLoop() { ALOGD("nuSensorService thread starting..."); - const size_t numEventMax = 16 * (1 + mVirtualSensorList.size()); - sensors_event_t buffer[numEventMax]; - sensors_event_t scratch[numEventMax]; + const size_t numEventMax = 16; + const size_t minBufferSize = numEventMax * mVirtualSensorList.size(); + sensors_event_t buffer[minBufferSize]; + sensors_event_t scratch[minBufferSize]; SensorDevice& device(SensorDevice::getInstance()); const size_t vcount = mVirtualSensorList.size(); @@ -255,10 +256,17 @@ bool SensorService::threadLoop() fusion.process(event[i]); } } - for (size_t i=0 ; i<size_t(count) ; i++) { + for (size_t i=0 ; i<size_t(count) && k<minBufferSize ; i++) { for (size_t j=0 ; j<activeVirtualSensorCount ; j++) { + if (count + k >= minBufferSize) { + ALOGE("buffer too small to hold all events: " + "count=%u, k=%u, size=%u", + count, k, minBufferSize); + break; + } sensors_event_t out; - if (virtualSensors.valueAt(j)->process(&out, event[i])) { + SensorInterface* si = virtualSensors.valueAt(j); + if (si->process(&out, event[i])) { buffer[count + k] = out; k++; } |