[sensors] Add parameter check to poll()

Check maxCount parameter so that it will not allocate overly large
amount of memory if input parameter is bad.

Bug: 32953589
Test: build and pass vts
Change-Id: Ia19e0315ab1623b8b6580889c1e058a19e6c9670

sensors/1.0/ISensors.hal

@@ -61,7 +61,9 @@ interface ISensors {
      * If there is no sensor event when this function is being called, block
      * until there are sensor events available.
      *
-     * @param  maxCount max number of samples can be returned.
+     * @param  maxCount max number of samples can be returned, must be > 0.
+     *         Actual number of events returned in data must be <= maxCount
+     *         and > 0.
      * @return result OK on success or BAD_VALUE if maxCount <= 0.
      * @return data vector of Event contains sensor events.
      * @return dynamicSensorsAdded vector of SensorInfo contains dynamic sensor

sensors/1.0/default/Sensors.cpp

@@ -151,12 +151,13 @@ Return<void> Sensors::poll(int32_t maxCount, poll_cb _hidl_cb) {
         return Void();
     }
 
-    std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[maxCount]);
+    int bufferSize = maxCount <= kPollMaxBufferSize ? maxCount : kPollMaxBufferSize;
+
+    std::unique_ptr<sensors_event_t[]> data(new sensors_event_t[bufferSize]);
 
     int err = mSensorDevice->poll(
             reinterpret_cast<sensors_poll_device_t *>(mSensorDevice),
-            data.get(),
-            maxCount);
+            data.get(), bufferSize);
 
     if (err < 0) {
         _hidl_cb(ResultFromStatus(err), out, dynamicSensorsAdded);

sensors/1.0/default/Sensors.h

@@ -27,6 +27,7 @@ namespace sensors {
 namespace V1_0 {
 namespace implementation {
 
+
 struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
     Sensors();
 
@@ -60,6 +61,7 @@ struct Sensors : public ::android::hardware::sensors::V1_0::ISensors {
             configDirectReport_cb _hidl_cb) override;
 
 private:
+    static constexpr int32_t kPollMaxBufferSize = 128;
     status_t mInitCheck;
     sensors_module_t *mSensorModule;
     sensors_poll_device_1_t *mSensorDevice;