Merge cherrypicks of [3898672, 3898782, 3898835, 3898616, 3898673, 3898682, 3898855, 3898856, 3897559, 3898859, 3898783, 3898784, 3898785, 3898786, 3898787, 3898043, 3898044, 3898045, 3898046, 3898047, 3897866, 3897936, 3898862, 3898726, 3898798, 3898762] into sparse-4669640-L20900000163300080android-8.1.0_r27oreo-m4-s2-release

Change-Id: Id8310ae0037bdc71ddaf44f224f35df2276c6891

1 files changed, 7 insertions, 1 deletions

diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index dc491d97c0..e5b6dcf750 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -21,6 +21,7 @@
 #include <cutils/properties.h>
 #include <hardware/sensors.h>
 #include <hardware_legacy/power.h>
+#include <log/log.h>
 #include <openssl/digest.h>
 #include <openssl/hmac.h>
 #include <openssl/rand.h>
@@ -993,10 +994,15 @@ sp<ISensorEventConnection> SensorService::createSensorDirectConnection(
     // check specific to memory type
     switch(type) {
         case SENSOR_DIRECT_MEM_TYPE_ASHMEM: { // channel backed by ashmem
+            if (resource->numFds < 1) {
+                ALOGE("Ashmem direct channel requires a memory region to be supplied");
+                android_errorWriteLog(0x534e4554, "70986337");  // SafetyNet
+                return nullptr;
+            }
             int fd = resource->data[0];
             int size2 = ashmem_get_size_region(fd);
             // check size consistency
-            if (size2 < static_cast<int>(size)) {
+            if (size2 < static_cast<int64_t>(size)) {
                 ALOGE("Ashmem direct channel size %" PRIu32 " greater than shared memory size %d",
                       size, size2);
                 return nullptr;