diff options
Diffstat (limited to 'libs/sensor/ISensorServer.cpp')
| -rw-r--r-- | libs/sensor/ISensorServer.cpp | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/libs/sensor/ISensorServer.cpp b/libs/sensor/ISensorServer.cpp index 8ed09f8ff0..a6cacad374 100644 --- a/libs/sensor/ISensorServer.cpp +++ b/libs/sensor/ISensorServer.cpp @@ -91,13 +91,14 @@ public: } virtual sp<ISensorEventConnection> createSensorEventConnection(const String8& packageName, - int mode, const String16& opPackageName) + int mode, const String16& opPackageName, const String16& attributionTag) { Parcel data, reply; data.writeInterfaceToken(ISensorServer::getInterfaceDescriptor()); data.writeString8(packageName); data.writeInt32(mode); data.writeString16(opPackageName); + data.writeString16(attributionTag); remote()->transact(CREATE_SENSOR_EVENT_CONNECTION, data, &reply); return interface_cast<ISensorEventConnection>(reply.readStrongBinder()); } @@ -170,8 +171,9 @@ status_t BnSensorServer::onTransact( String8 packageName = data.readString8(); int32_t mode = data.readInt32(); const String16& opPackageName = data.readString16(); + const String16& attributionTag = data.readString16(); sp<ISensorEventConnection> connection(createSensorEventConnection(packageName, mode, - opPackageName)); + opPackageName, attributionTag)); reply->writeStrongBinder(IInterface::asBinder(connection)); return NO_ERROR; } @@ -216,14 +218,25 @@ status_t BnSensorServer::onTransact( int32_t type; Vector<float> floats; Vector<int32_t> ints; + uint32_t count; handle = data.readInt32(); type = data.readInt32(); - floats.resize(data.readUint32()); + + count = data.readUint32(); + if (count > (data.dataAvail() / sizeof(float))) { + return BAD_VALUE; + } + floats.resize(count); for (auto &i : floats) { i = data.readFloat(); } - ints.resize(data.readUint32()); + + count = data.readUint32(); + if (count > (data.dataAvail() / sizeof(int32_t))) { + return BAD_VALUE; + } + ints.resize(count); for (auto &i : ints) { i = data.readInt32(); } |