commit 68e00893f7400d1ce71a9ed92365ffdfd6730c03
author Miao Wang <miaowang@google.com> Thu Feb 25 12:44:10 2016 -0800
committer Miao Wang <miaowang@google.com> Fri Feb 26 00:53:46 2016 +0000
tree d4e0055948261b264feb64085e635f3456aaab4c
parent 464c8cc19dacc544a16b2a0ffb104d4a4c25753b

Better handle error log and nullptr reference.

Bug: 27367378

Change-Id: Ide29c702d7a70dfe087ddc600d3fd17279223196

cpu_ref/rsCpuScript.cpp

diff --git a/cpu_ref/rsCpuScript.cpp b/cpu_ref/rsCpuScript.cpp
index 508381f..16b3ec6 100644
--- a/cpu_ref/rsCpuScript.cpp
+++ b/cpu_ref/rsCpuScript.cpp
@@ -674,6 +674,12 @@
                                         const void * usr, uint32_t usrLen,
                                         const RsScriptCall *sc,
                                         MTLaunchStructForEach *mtls) {
+    if (ains == nullptr && inLen != 0) {
+        mCtx->getContext()->setError(RS_ERROR_BAD_SCRIPT,
+          "rsForEach called with none-zero inLen with null in allocations");
+        return false;
+    }
+
     memset(mtls, 0, sizeof(MTLaunchStructForEach));
     mtls->dimPtr = &mtls->fep.dim;
 

driver/rsdRuntimeStubs.cpp

diff --git a/driver/rsdRuntimeStubs.cpp b/driver/rsdRuntimeStubs.cpp
index 5841991..2ac731d 100644
--- a/driver/rsdRuntimeStubs.cpp
+++ b/driver/rsdRuntimeStubs.cpp
@@ -138,7 +138,7 @@
 
     if (impl->getInForEach()) {
         char buf[256];
-        sprintf(buf, "Error: Call to unsupported function %s "
+        snprintf(buf, sizeof(buf), "Error: Call to unsupported function %s "
                          "in kernel", funcName);
         rsc->setError(RS_ERROR_FATAL_DRIVER, buf);
         return true;
@@ -441,32 +441,32 @@
 
     char buf[256];
     if (x && (x >= t->getLODDimX(0))) {
-        sprintf(buf, "Out range ElementAt X %i of %i", x, t->getLODDimX(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt X %i of %i", x, t->getLODDimX(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (y && (y >= t->getLODDimY(0))) {
-        sprintf(buf, "Out range ElementAt Y %i of %i", y, t->getLODDimY(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt Y %i of %i", y, t->getLODDimY(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (z && (z >= t->getLODDimZ(0))) {
-        sprintf(buf, "Out range ElementAt Z %i of %i", z, t->getLODDimZ(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt Z %i of %i", z, t->getLODDimZ(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (vecSize > 0) {
         if (vecSize != e->getVectorSize()) {
-            sprintf(buf, "Vector size mismatch for ElementAt %i of %i", vecSize, e->getVectorSize());
+            snprintf(buf, sizeof(buf), "Vector size mismatch for ElementAt %i of %i", vecSize, e->getVectorSize());
             rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
             return nullptr;
         }
 
         if (dt != e->getType()) {
-            sprintf(buf, "Data type mismatch for ElementAt %i of %i", dt, e->getType());
+            snprintf(buf, sizeof(buf), "Data type mismatch for ElementAt %i of %i", dt, e->getType());
             rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
             return nullptr;
         }