commit a3a04e0dbca5e4049054c7fa3660f305ec8b9a3e
author Luca Weiss <luca.weiss@fairphone.com> Mon Jul 26 13:42:26 2021 +0200
committer Luca Weiss <luca.weiss@fairphone.com> Mon Jul 26 13:42:27 2021 +0200
tree 6825be39552853df6524a006413a8171957ab1e1
parent 4b7ef95e7ff11173e372b0ceaf1044d7f2408216
parent a936bfa7993d5878cb53dee0c829be9ca10b0c73

Merge the 2021-08-05 SPL branch from AOSP-Partner

* security-aosp-pi-release:
  audio HAL - fix UAFs

Change-Id: I4cf0d75b2d7c8828ef64d945740078020ec9f605

gnss/1.0/default/Gnss.cpp

diff --git a/gnss/1.0/default/Gnss.cpp b/gnss/1.0/default/Gnss.cpp
index 32c131c..5bc6d80 100644
--- a/gnss/1.0/default/Gnss.cpp
+++ b/gnss/1.0/default/Gnss.cpp
@@ -198,6 +198,10 @@
     uint32_t ephemerisMask = svInfo->ephemeris_mask;
     uint32_t almanacMask = svInfo->almanac_mask;
     uint32_t usedInFixMask = svInfo->used_in_fix_mask;
+    // Our HALs report a bigger svinfo struct, HaxxSvStatus, which includes a GLONASS and
+    // a Beidou usage mask
+    uint32_t gloUsedInFixMask = *(&(svInfo->used_in_fix_mask) + 1); // the next int
+    uint64_t bdsUsedInFixMask = *(&(svInfo->used_in_fix_mask) + 2); // the next int
     /*
      * Conversion from GpsSvInfo to IGnssCallback::GnssSvInfo happens below.
      */
@@ -231,10 +235,13 @@
         info.svFlag = static_cast<uint8_t>(IGnssCallback::GnssSvFlags::NONE);
 
         /*
-         * Only GPS info is valid for these fields, as these masks are just 32
-         * bits, by GPS prn.
+         * GPS, GLONASS and Beidou info is valid for these fields, as these masks
+         * are just 32/64 bits, by GPS prn, another for GLONASS prn and another
+         * for Beidou prn.
          */
-        if (info.constellation == GnssConstellationType::GPS) {
+        if (info.constellation == GnssConstellationType::GPS ||
+            info.constellation == GnssConstellationType::GLONASS ||
+            info.constellation == GnssConstellationType::BEIDOU) {
             int32_t svidMask = (1 << (info.svid - 1));
             if ((ephemerisMask & svidMask) != 0) {
                 info.svFlag |= IGnssCallback::GnssSvFlags::HAS_EPHEMERIS_DATA;
@@ -242,7 +249,12 @@
             if ((almanacMask & svidMask) != 0) {
                 info.svFlag |= IGnssCallback::GnssSvFlags::HAS_ALMANAC_DATA;
             }
-            if ((usedInFixMask & svidMask) != 0) {
+            if ((info.constellation == GnssConstellationType::GPS &&
+                 (usedInFixMask & svidMask) != 0) ||
+                (info.constellation == GnssConstellationType::GLONASS &&
+                 (gloUsedInFixMask & svidMask) != 0) ||
+                (info.constellation == GnssConstellationType::BEIDOU &&
+                 (bdsUsedInFixMask & svidMask) != 0)) {
                 info.svFlag |= IGnssCallback::GnssSvFlags::USED_IN_FIX;
             }
         }