From ec1783828e541f22e93e67ec80511b9187bc93be Mon Sep 17 00:00:00 2001
From: Zachary Kuznia <zork@google.com>
Date: Fri, 13 May 2016 13:11:36 -0700
Subject: [PATCH] Ensure MotionEvent.split() won't be given an invalid value.

b/27496784

Change-Id: I28bb4ac5bb8a705e7af9b22b2b56cd4061aa06a0
---
 .../server/accessibility/TouchExplorer.java        | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/TouchExplorer.java b/services/accessibility/java/com/android/server/accessibility/TouchExplorer.java
index 3cc991cab65d8..ecba24501a3e8 100644
--- a/services/accessibility/java/com/android/server/accessibility/TouchExplorer.java
+++ b/services/accessibility/java/com/android/server/accessibility/TouchExplorer.java
@@ -648,7 +648,16 @@ class TouchExplorer implements EventStreamTransformation, AccessibilityGestureDe
      * @param policyFlags The policy flags associated with the event.
      */
     private void handleMotionEventStateDragging(MotionEvent event, int policyFlags) {
-        final int pointerIdBits = (1 << mDraggingPointerId);
+        int pointerIdBits = 0;
+        // Clear the dragging pointer id if it's no longer valid.
+        if (event.findPointerIndex(mDraggingPointerId) == -1) {
+            Slog.e(LOG_TAG, "mDraggingPointerId doesn't match any pointers on current event. " +
+                    "mDraggingPointerId: " + Integer.toString(mDraggingPointerId) +
+                    ", Event: " + event);
+            mDraggingPointerId = INVALID_POINTER_ID;
+        } else {
+            pointerIdBits = (1 << mDraggingPointerId);
+        }
         switch (event.getActionMasked()) {
             case MotionEvent.ACTION_DOWN: {
                 throw new IllegalStateException("Dragging state can be reached only if two "
@@ -664,6 +673,9 @@ class TouchExplorer implements EventStreamTransformation, AccessibilityGestureDe
                 sendDownForAllNotInjectedPointers(event, policyFlags);
             } break;
             case MotionEvent.ACTION_MOVE: {
+                if (mDraggingPointerId == INVALID_POINTER_ID) {
+                    break;
+                }
                 switch (event.getPointerCount()) {
                     case 1: {
                         // do nothing