add number constraint for samples per MotionEvent am: 5d17838ade am: 72c8ca4a01

am: 9964d83869

* commit '9964d83869565cf4dda432129cfe50f6ede19338':
  add number constraint for samples per MotionEvent

2 files changed, 7 insertions, 1 deletions

diff --git a/include/input/Input.h b/include/input/Input.h
index 96b6885091..a8df11bde1 100644
--- a/include/input/Input.h
+++ b/include/input/Input.h
@@ -111,6 +111,11 @@ enum {
 #define MAX_POINTERS 16
 
 /*
+ * Maximum number of samples supported per motion event.
+ */
+#define MAX_SAMPLES UINT16_MAX
+
+/*
  * Maximum pointer id value supported in a motion event.
  * Smallest pointer id is 0.
  * (This is limited by our use of BitSet32 to track pointer assignments.)
diff --git a/libs/input/Input.cpp b/libs/input/Input.cpp
index 3a7afe9cb6..cd55ee54bf 100644
--- a/libs/input/Input.cpp
+++ b/libs/input/Input.cpp
@@ -421,7 +421,8 @@ void MotionEvent::transform(const float matrix[9]) {
 status_t MotionEvent::readFromParcel(Parcel* parcel) {
     size_t pointerCount = parcel->readInt32();
     size_t sampleCount = parcel->readInt32();
-    if (pointerCount == 0 || pointerCount > MAX_POINTERS || sampleCount == 0) {
+    if (pointerCount == 0 || pointerCount > MAX_POINTERS ||
+            sampleCount == 0 || sampleCount > MAX_SAMPLES) {
         return BAD_VALUE;
     }