Gralloc: Use handle reserved size while importing buffer
Instead of metadata reserved_size, use handle reserved size while
import as metadata reserved size can be modified by client which
can cause memory corruption.
Bug: 253297595
Change-Id: Iedbb9eea589b56e81e044603c958f0b2c4cb3720
Signed-off-by: Guus Sliepen <[email protected]>
diff --git a/gralloc/gr_buf_mgr.cpp b/gralloc/gr_buf_mgr.cpp
index 72b72fb..61249a9 100644
--- a/gralloc/gr_buf_mgr.cpp
+++ b/gralloc/gr_buf_mgr.cpp
@@ -806,9 +806,8 @@
auto buffer = std::make_shared<Buffer>(hnd, ion_handle, ion_handle_meta);
if (hnd->base_metadata) {
- auto metadata = reinterpret_cast<MetaData_t *>(hnd->base_metadata);
#ifdef METADATA_V2
- buffer->reserved_size = metadata->reservedSize;
+ buffer->reserved_size = hnd->reserved_size;
if (buffer->reserved_size > 0) {
buffer->reserved_region_ptr =
reinterpret_cast<void *>(hnd->base_metadata + sizeof(MetaData_t));
