commit c33c441bf2093c770793437b56809b955ce449b4
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Aug 03 17:06:08 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Aug 03 17:06:08 2020 +0000
tree 56446bb94c3cd56a329e274824c9add82a4e23d6
parent f4785c6db2448d671974fd749b5ad36472e17c27
parent 567239b3363f11bfdf2738e908b1f1a83c83567b

Merge "libgui: layer_state_t::read() check null" into rvc-dev-plus-aosp am: 4c924bab94 am: e6f76cfafc am: 567239b336

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/12184116

Change-Id: I2a35ec39c28b72c47d8baf4688ebab92e1835391

libs/gui/LayerState.cpp

diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index 55dbcd1..b215756 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -176,7 +176,12 @@
         sidebandStream = NativeHandle::create(input.readNativeHandle(), true);
     }
 
-    colorTransform = mat4(static_cast<const float*>(input.readInplace(16 * sizeof(float))));
+    const void* color_transform_data = input.readInplace(16 * sizeof(float));
+    if (color_transform_data) {
+        colorTransform = mat4(static_cast<const float*>(color_transform_data));
+    } else {
+        return BAD_VALUE;
+    }
     cornerRadius = input.readFloat();
     backgroundBlurRadius = input.readUint32();
     cachedBuffer.token = input.readStrongBinder();