Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a stack corruption in sensorservice

Browse Source 
Bug: 6576732
Change-Id: If0f2fb0d0c35b932fb77cd262e676042145b28f9
This commit is contained in:
Mathias Agopian
2012-05-29 19:46:14 -07:00
parent a27551dde8
commit 8fd03f4ea4
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
services/sensorservice/SensorService.cpp
View File

@@ -225,9 +225,10 @@ bool SensorService::threadLoop()
{
ALOGD("nuSensorService thread starting...");
const size_t numEventMax = 16 * (1 + mVirtualSensorList.size());
sensors_event_t buffer[numEventMax];
sensors_event_t scratch[numEventMax];
const size_t numEventMax = 16;
const size_t minBufferSize = numEventMax * mVirtualSensorList.size();
sensors_event_t buffer[minBufferSize];
sensors_event_t scratch[minBufferSize];
SensorDevice& device(SensorDevice::getInstance());
const size_t vcount = mVirtualSensorList.size();
@@ -255,10 +256,17 @@ bool SensorService::threadLoop()
fusion.process(event[i]);
}
}
for (size_t i=0 ; i<size_t(count) ; i++) {
for (size_t i=0 ; i<size_t(count) && k<minBufferSize ; i++) {
for (size_t j=0 ; j<activeVirtualSensorCount ; j++) {
if (count + k >= minBufferSize) {
ALOGE("buffer too small to hold all events: "
"count=%u, k=%u, size=%u",
count, k, minBufferSize);
break;
}
sensors_event_t out;
if (virtualSensors.valueAt(j)->process(&out, event[i])) {
SensorInterface* si = virtualSensors.valueAt(j);
if (si->process(&out, event[i])) {
buffer[count + k] = out;
k++;
}