commit 9809602ac32dcb7bceaa5bc34df5b7fb68aacd38
author Chris Forbes <chrisforbes@google.com> Wed May 10 13:12:00 2017 -0700
committer Chris Forbes <chrisforbes@google.com> Tue May 16 18:30:27 2017 +0000
tree a55bf742ea6a2bfdc4add2451350794081ab5e6d
parent 2ae83f4f628d4da96f363d0668380ba1f753b867

ui: Fix bad size check in Fence::unflatten

Differs slightly from mnc+ patch: GetFlattenedSize was fixed in mnc.

Test: Boot device, run poc from bug, observe no longer crashes
Bug: 37285689
Change-Id: Id8b851733b088cce0d07493fbf76e7e24f9299ad

libs/ui/Fence.cpp

diff --git a/libs/ui/Fence.cpp b/libs/ui/Fence.cpp
index 93ec0ce..2a77150 100644
--- a/libs/ui/Fence.cpp
+++ b/libs/ui/Fence.cpp
@@ -127,7 +127,7 @@
 }
 
 size_t Fence::getFlattenedSize() const {
-    return 1;
+    return 4;
 }
 
 size_t Fence::getFdCount() const {
@@ -152,7 +152,7 @@
         return INVALID_OPERATION;
     }
 
-    if (size < 1) {
+    if (size < getFlattenedSize()) {
         return NO_MEMORY;
     }