Merge cherrypicks of [12932958, 12933116, 12932959, 12932960, 12933063, 12933064, 12932558, 12932852, 12932349, 12932649, 12932853, 12932854, 12932650, 12933102, 12932350, 12933103, 12933295, 12932351, 12932651, 12932652, 12933104, 12933105, 12933315, 12932584, 12933260, 12932559, 12933176, 12932560, 12932561, 12932352, 12932353] into sparse-6782484-L76100000728111977android-11.0.0_r25android11-s1-release

Change-Id: I5783cbd7d343b039189ab7003fb9ca41e5f167d5

1 files changed, 9 insertions, 1 deletions

diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 03903f6d07..3bd3139888 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -2403,7 +2403,15 @@ InputWindowInfo Layer::fillInputInfo() {
     xSurfaceInset = (xSurfaceInset >= 0) ? std::min(xSurfaceInset, layerBounds.getWidth() / 2) : 0;
     ySurfaceInset = (ySurfaceInset >= 0) ? std::min(ySurfaceInset, layerBounds.getHeight() / 2) : 0;
 
-    layerBounds.inset(xSurfaceInset, ySurfaceInset, xSurfaceInset, ySurfaceInset);
+    // inset while protecting from overflow TODO(b/161235021): What is going wrong
+    // in the overflow scenario?
+    {
+    int32_t tmp;
+    if (!__builtin_add_overflow(layerBounds.left, xSurfaceInset, &tmp)) layerBounds.left = tmp;
+    if (!__builtin_sub_overflow(layerBounds.right, xSurfaceInset, &tmp)) layerBounds.right = tmp;
+    if (!__builtin_add_overflow(layerBounds.top, ySurfaceInset, &tmp)) layerBounds.top = tmp;
+    if (!__builtin_sub_overflow(layerBounds.bottom, ySurfaceInset, &tmp)) layerBounds.bottom = tmp;
+    }
 
     // Input coordinate should match the layer bounds.
     info.frameLeft = layerBounds.left;