From 2201d08f8dc9d48bcb4bd13690e061013bdeeb91 Mon Sep 17 00:00:00 2001
From: Tao Bao <tbao@google.com>
Date: Mon, 26 Nov 2018 15:46:05 -0800
Subject: [PATCH] minui: Fix a wrong arg in calling GRSurface::Create().

This is a bug introduced while refactoring init_display_surface(), in
[1]. As a result, user of res_create_multi_display_surface(), which is
effectively `charger` right now, crashes due to buffer overrun.

This CL fixes the wrong arg and adds a sanity test for
res_create_multi_display_surface(). The testdata (battery_scale.png) is
copied from system/core/healthd/images/battery_scale.png.

[1] commit 44820ac1e31ffa029ab5baa71238a11b6db3e6cc.

Bug: 119122296
Test: Run recovery_unit_test on marlin.
Test: Build and boot into charger mode on blueline. Verify that
      `charger` no longer crashes.
Change-Id: Ib6d083e1512a9c3c6eb63874d26d22658921d693
---
 minui/resources.cpp              |   2 +-
 tests/testdata/battery_scale.png | Bin 0 -> 463 bytes
 tests/unit/resources_test.cpp    |  37 +++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 tests/testdata/battery_scale.png
 create mode 100644 tests/unit/resources_test.cpp

diff --git a/minui/resources.cpp b/minui/resources.cpp
index c7af1904..057d3fd0 100644
--- a/minui/resources.cpp
+++ b/minui/resources.cpp
@@ -261,7 +261,7 @@ int res_create_multi_display_surface(const char* name, int* frames, int* fps,
   for (int i = 0; i < *frames; ++i) {
     auto height_per_frame = height / *frames;
     auto created_surface =
-        GRSurface::Create(width, height_per_frame, width * 4, 4, width * height_per_frame);
+        GRSurface::Create(width, height_per_frame, width * 4, 4, width * height_per_frame * 4);
     if (!created_surface) {
       result = -8;
       goto exit;
diff --git a/tests/testdata/battery_scale.png b/tests/testdata/battery_scale.png
new file mode 100644
index 0000000000000000000000000000000000000000..2ae8f0fd7e501b439dfdda2486e87b5b6ba54d4d
GIT binary patch
literal 463
zcmeAS@N?(olHy`uVBq!ia0vp^6$}h4F)YkL)?y2fOF)W0z$e5NNdE_cGeBT$Z2VW?
zhXYWEqr^3$#H}bXH?^3-EdIluXABIC>7Fi*Ar*{ouWjUPFc5LQ$ibIjR>1Oo{yDpZ
zkD(PUbHblHSzOJ3yzSqP;+p8r{wSS&VJwS%r6qE2CEePR$&A8`zGMI9c!Z8v_tB({
zJN8ED+<Sa~p66_{T%f|s%Y0{VtKMw@Wx~Y>GWr@W0<{uUMo>-b#d#t<lpC|95z{&D
k5bt3%JZU31JRV6qWUTo+<N0(>U^Fmzy85}Sb4q9e0C{iTuK)l5

literal 0
HcmV?d00001

diff --git a/tests/unit/resources_test.cpp b/tests/unit/resources_test.cpp
new file mode 100644
index 00000000..c3f72718
--- /dev/null
+++ b/tests/unit/resources_test.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <gtest/gtest.h>
+
+#include "common/test_constants.h"
+#include "minui/minui.h"
+
+TEST(ResourcesTest, res_create_multi_display_surface) {
+  GRSurface** frames;
+  int frame_count;
+  int fps;
+  ASSERT_EQ(0, res_create_multi_display_surface(from_testdata_base("battery_scale.png").c_str(),
+                                                &frame_count, &fps, &frames));
+  ASSERT_EQ(6, frame_count);
+  ASSERT_EQ(20, fps);
+
+  for (auto i = 0; i < frame_count; i++) {
+    free(frames[i]);
+  }
+  free(frames);
+}