Don't pass up bad sensor event packets to Sensor Services
If an event packet is read containing an unknown sensor handle,
don't pass it on to Sensor Services. Drop it on the floor instead
as it's causing Sensor Services to crash.
Moved read of queue size in sensors_poll_context_t::poll() to post
queue mutex grab for safety.
Bug: 15285345
Change-Id: I2ebc0f8591a1ae60f09bf9599b8321c5a3dfae69
diff --git a/modules/sensors/multihal.cpp b/modules/sensors/multihal.cpp
index 5fd500a..76ec161 100644
--- a/modules/sensors/multihal.cpp
+++ b/modules/sensors/multihal.cpp
@@ -299,10 +299,11 @@
int sensors_poll_context_t::poll(sensors_event_t *data, int maxReads) {
ALOGV("poll");
int empties = 0;
- int queueCount = (int)this->queues.size();
+ int queueCount = 0;
int eventsRead = 0;
pthread_mutex_lock(&queue_mutex);
+ queueCount = (int)this->queues.size();
while (eventsRead == 0) {
while (empties < queueCount && eventsRead < maxReads) {
SensorEventQueue* queue = this->queues.at(this->nextReadIndex);
@@ -311,7 +312,13 @@
empties++;
} else {
empties = 0;
- this->copy_event_remap_handle(&data[eventsRead++], event, nextReadIndex);
+ this->copy_event_remap_handle(&data[eventsRead], event, nextReadIndex);
+ if (data[eventsRead].sensor == -1) {
+ // Bad handle, do not pass corrupted event upstream !
+ ALOGW("Dropping bad local handle event packet on the floor");
+ } else {
+ eventsRead++;
+ }
queue->dequeue();
}
this->nextReadIndex = (this->nextReadIndex + 1) % queueCount;