mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
65 lines
2.9 KiB
Diff
65 lines
2.9 KiB
Diff
From 9a005ebebfa638ed42415301fec30b16bef30299 Mon Sep 17 00:00:00 2001
|
|
From: Devin Moore <devinmoore@google.com>
|
|
Date: Mon, 22 Jan 2024 17:52:16 +0000
|
|
Subject: [PATCH] Use the values of the ptrs that we check
|
|
|
|
Test: fmq_fuzzer
|
|
Bug: 321326147
|
|
Bug: 321341508
|
|
Bug: 321383085
|
|
(cherry picked from https://android-review.googlesource.com/q/commit:38963310ad5789b625ca0bca9f9c2c8e24666651)
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:050952bf5f9bd035e469ce005300115d563e524a)
|
|
Merged-In: I56fe4fe72180e39ecef066353969c1ae9fbcd44e
|
|
Change-Id: I56fe4fe72180e39ecef066353969c1ae9fbcd44e
|
|
---
|
|
include/fmq/MessageQueueBase.h | 24 ++++++++++++++++++++----
|
|
1 file changed, 20 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/include/fmq/MessageQueueBase.h b/include/fmq/MessageQueueBase.h
|
|
index f4bf7e2..0bf0bb2 100644
|
|
--- a/include/fmq/MessageQueueBase.h
|
|
+++ b/include/fmq/MessageQueueBase.h
|
|
@@ -1034,8 +1034,16 @@ bool MessageQueueBase<MQDescriptorType, T, flavor>::readBlocking(T* data, size_t
|
|
}
|
|
|
|
template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor>
|
|
-size_t MessageQueueBase<MQDescriptorType, T, flavor>::availableToWriteBytes() const {
|
|
- return mDesc->getSize() - availableToReadBytes();
|
|
+inline size_t MessageQueueBase<MQDescriptorType, T, flavor>::availableToWriteBytes() const {
|
|
+ size_t queueSizeBytes = mDesc->getSize();
|
|
+ size_t availableBytes = availableToReadBytes();
|
|
+ if (queueSizeBytes < availableBytes) {
|
|
+ hardware::details::logError(
|
|
+ "The write or read pointer has become corrupted. Reading from the queue is no "
|
|
+ "longer possible.");
|
|
+ return 0;
|
|
+ }
|
|
+ return queueSizeBytes - availableBytes;
|
|
}
|
|
|
|
template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor>
|
|
@@ -1117,13 +1125,21 @@ MessageQueueBase<MQDescriptorType, T, flavor>::commitWrite(size_t nMessages) {
|
|
}
|
|
|
|
template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor>
|
|
-size_t MessageQueueBase<MQDescriptorType, T, flavor>::availableToReadBytes() const {
|
|
+inline size_t MessageQueueBase<MQDescriptorType, T, flavor>::availableToReadBytes() const {
|
|
/*
|
|
* This method is invoked by implementations of both read() and write() and
|
|
* hence requires a memory_order_acquired load for both mReadPtr and
|
|
* mWritePtr.
|
|
*/
|
|
- return mWritePtr->load(std::memory_order_acquire) - mReadPtr->load(std::memory_order_acquire);
|
|
+ uint64_t writePtr = mWritePtr->load(std::memory_order_acquire);
|
|
+ uint64_t readPtr = mReadPtr->load(std::memory_order_acquire);
|
|
+ if (writePtr < readPtr) {
|
|
+ hardware::details::logError(
|
|
+ "The write or read pointer has become corrupted. Reading from the queue is no "
|
|
+ "longer possible.");
|
|
+ return 0;
|
|
+ }
|
|
+ return writePtr - readPtr;
|
|
}
|
|
|
|
template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor>
|