From 56150f76db2f976d5541177544e24efded2b1c57 Mon Sep 17 00:00:00 2001 From: bailu1992 Date: Wed, 9 Jul 2025 14:28:47 +0800 Subject: [PATCH] Check for loop conditions Signed-off-by: bailu1992 --- .../vibrator/src/vibrator_service_client.cpp | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/frameworks/native/vibrator/src/vibrator_service_client.cpp b/frameworks/native/vibrator/src/vibrator_service_client.cpp index 63a816e..c9d1715 100644 --- a/frameworks/native/vibrator/src/vibrator_service_client.cpp +++ b/frameworks/native/vibrator/src/vibrator_service_client.cpp @@ -51,7 +51,7 @@ static constexpr int32_t MAX_PATTERN_EVENT_NUM = 1000; static constexpr int32_t MAX_PATTERN_NUM = 1000; static constexpr int32_t CURVE_POINT_NUM_MIN = 4; static constexpr int32_t CURVE_POINT_NUM_MAX = 16; - +static constexpr int32_t EVENT_NUM_MAX = 16; using namespace OHOS::HiviewDFX; namespace { @@ -950,6 +950,14 @@ void VibratorServiceClient::ConvertSeekVibratorPackage(const VibratorPackage &co continue; } vibratePattern.startTime = seekTime; + if (completePackage.patterns[i].eventNum <= 0 || completePackage.patterns[i].eventNum > EVENT_NUM_MAX) { + MISC_HILOGE("The size of pattern is out of bounds, size:%{public}d", completePackage.patterns[i].eventNum); + if (vibratePattern.events.empty()) { + continue; + } + convertPackage.patterns.emplace_back(vibratePattern); + continue; + } for (int32_t j = 0; j < completePackage.patterns[i].eventNum; ++j) { VibrateEvent vibrateEvent = {}; if (SkipEventAndConvertVibratorEvent(completePackage.patterns[i].events[j], vibratePattern, @@ -966,7 +974,14 @@ void VibratorServiceClient::ConvertSeekVibratorPackage(const VibratorPackage &co vibrateEvent.intensity = completePackage.patterns[i].events[j].intensity; vibrateEvent.frequency = completePackage.patterns[i].events[j].frequency; vibrateEvent.index = completePackage.patterns[i].events[j].index; - for (size_t k = 0; k < static_cast(completePackage.patterns[i].events[j].pointNum); ++k) { + int32_t pointNum = completePackage.patterns[i].events[j].pointNum; + if ((pointNum < CURVE_POINT_NUM_MIN) || (pointNum > CURVE_POINT_NUM_MAX)) { + MISC_HILOGE("The size of curve point is out of bounds, size:%{public}d", pointNum); + vibratePattern.patternDuration += vibrateEvent.duration; + vibratePattern.events.emplace_back(vibrateEvent); + continue; + } + for (size_t k = 0; k < static_cast(pointNum); ++k) { VibrateCurvePoint vibrateCurvePoint = {}; vibrateCurvePoint.time = completePackage.patterns[i].events[j].points[k].time; vibrateCurvePoint.intensity = completePackage.patterns[i].events[j].points[k].intensity; -- Gitee