Merge "[VTS 2.3] Add length check before reading blob" into udc-dev

This commit is contained in:
Ram Indani
2023-05-30 16:24:09 +00:00
committed by Android (Google) Code Review

View File

@@ -82,7 +82,7 @@ class ComposerCommandEngine : public V2_2::hal::ComposerCommandEngine {
std::vector<IComposerClient::PerFrameMetadataBlob> metadata;
for (size_t i = 0; i < numBlobs; i++) {
for (size_t i = 0; i < numBlobs && length >= 2; i++) {
IComposerClient::PerFrameMetadataKey key =
static_cast<IComposerClient::PerFrameMetadataKey>(readSigned());
uint32_t blobSize = read();