Seeing crashes likely from negative touch indexes, check for them

ui/events/ozone/evdev/touch_event_converter_evdev.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/events/ozone/evdev/touch_event_converter_evdev.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/input.h>
 #include <poll.h>
@@ skipping 152 matching lines @@
     ProcessInputEvent(inputs[i]);
   }
 }
 
 void TouchEventConverterEvdev::ProcessInputEvent(const input_event& input) {
   if (input.type == EV_SYN) {
     ProcessSyn(input);
   } else if(syn_dropped_) {
     // Do nothing. This branch indicates we have lost sync with the driver.
   } else if (input.type == EV_ABS) {
-    if (current_slot_ >= MAX_FINGERS) {
-      LOG(ERROR) << "too many touch events: " << current_slot_;
+    if ((current_slot_ >= MAX_FINGERS || current_slot_ < 0) &&
+        input.code != ABS_MT_SLOT) {

[spang, 2015/02/02 19:22:00]

Can't we keep the range check inside "case ABS_MT_SLOT"?

I don't see why we'd do it for every event. It should only be necessary when
updating current_slot_.

+      LOG(ERROR) << "invalid touch event index: " << current_slot_;
       return;
     }
     ProcessAbs(input);
   } else if (input.type == EV_KEY) {
     switch (input.code) {
       case BTN_TOUCH:
         break;
       default:
         NOTIMPLEMENTED() << "invalid code for EV_KEY: " << input.code;
     }
@@ skipping 31 matching lines @@
         events_[current_slot_].finger_ = input.value;
         events_[current_slot_].type_ = ET_TOUCH_PRESSED;
       }
       break;
     case ABS_MT_PRESSURE:
       altered_slots_.set(current_slot_);
       events_[current_slot_].pressure_ = input.value - pressure_min_;
       events_[current_slot_].pressure_ /= pressure_max_ - pressure_min_;
       break;
     case ABS_MT_SLOT:
-      if (input.value >= MAX_FINGERS) {
-        LOG(ERROR) << "multi-touch slot " << input.value
-                   << " exceeds MAX_FINGERS";
-        break;
-      }
       current_slot_ = input.value;
-      altered_slots_.set(current_slot_);
       break;
     default:
       DVLOG(5) << "unhandled code for EV_ABS: " << input.code;
   }
 }
 
 void TouchEventConverterEvdev::ProcessSyn(const input_event& input) {
   switch (input.code) {
     case SYN_REPORT:
       if (syn_dropped_) {
@@ skipping 43 matching lines @@
 
       // Subsequent events for this finger will be touch-move until it
       // is released.
       events_[i].type_ = ET_TOUCH_MOVED;
     }
   }
   altered_slots_.reset();
 }
 
 }  // namespace ui