Seeing crashes likely from negative touch indexes, check for them

ui/events/ozone/evdev/touch_event_converter_evdev.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/events/ozone/evdev/touch_event_converter_evdev.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <linux/input.h>
 #include <poll.h>
@@ skipping 42 matching lines @@
     if (!base::StringToInt(parts[3], &cal->bezel_bottom))
       DLOG(ERROR) << "Incorrect bottom border calibration value passed.";
   }
 }
 
 }  // namespace
 
 namespace ui {
 
 TouchEventConverterEvdev::InProgressEvents::InProgressEvents()
-    : x_(0),
+    : altered_(false),
+      x_(0),
       y_(0),
       id_(-1),
       finger_(-1),
       type_(ET_UNKNOWN),
       radius_x_(0),
       radius_y_(0),
       pressure_(0) {
 }
 
 TouchEventConverterEvdev::TouchEventConverterEvdev(
@@ skipping 32 matching lines @@
     y_num_tuxels_ -= cal.bezel_top + cal.bezel_bottom;
 
     VLOG(1) << "applying touch calibration: "
             << base::StringPrintf("[%d, %d, %d, %d]", cal.bezel_left,
                                   cal.bezel_right, cal.bezel_top,
                                   cal.bezel_bottom);
   }
 
   native_size_ = gfx::Size(x_num_tuxels_, y_num_tuxels_);
 
-  for (int i = 0;
-       i < std::min<int>(info.GetAbsMaximum(ABS_MT_SLOT) + 1, MAX_FINGERS);
-       ++i) {
+  events_.resize(
+      std::min<int>(info.GetAbsMaximum(ABS_MT_SLOT) + 1, MAX_FINGERS));
+  for (int i = 0; i < events_.size(); ++i) {
     events_[i].finger_ = info.GetSlotValue(ABS_MT_TRACKING_ID, i);
     events_[i].type_ =
         events_[i].finger_ < 0 ? ET_TOUCH_RELEASED : ET_TOUCH_PRESSED;
     events_[i].x_ = info.GetSlotValue(ABS_MT_POSITION_X, i);
     events_[i].y_ = info.GetSlotValue(ABS_MT_POSITION_Y, i);
     events_[i].radius_x_ = info.GetSlotValue(ABS_MT_TOUCH_MAJOR, i);
     events_[i].radius_y_ = info.GetSlotValue(ABS_MT_TOUCH_MINOR, i);
     events_[i].pressure_ = info.GetSlotValue(ABS_MT_PRESSURE, i);
   }
 }
@@ skipping 34 matching lines @@
     ProcessInputEvent(inputs[i]);
   }
 }
 
 void TouchEventConverterEvdev::ProcessInputEvent(const input_event& input) {
   if (input.type == EV_SYN) {
     ProcessSyn(input);
   } else if(syn_dropped_) {
     // Do nothing. This branch indicates we have lost sync with the driver.
   } else if (input.type == EV_ABS) {
-    if (current_slot_ >= MAX_FINGERS) {
-      LOG(ERROR) << "too many touch events: " << current_slot_;
-      return;
-    }
     ProcessAbs(input);
   } else if (input.type == EV_KEY) {
     switch (input.code) {
       case BTN_TOUCH:
         break;
       default:
         NOTIMPLEMENTED() << "invalid code for EV_KEY: " << input.code;
     }
   } else {
     NOTIMPLEMENTED() << "invalid type: " << input.type;
   }
 }
 
 void TouchEventConverterEvdev::ProcessAbs(const input_event& input) {
   switch (input.code) {
     case ABS_MT_TOUCH_MAJOR:
-      altered_slots_.set(current_slot_);
       // TODO(spang): If we have all of major, minor, and orientation,
       // we can scale the ellipse correctly. However on the Pixel we get
       // neither minor nor orientation, so this is all we can do.
       events_[current_slot_].radius_x_ = input.value / 2.0f;
       break;
     case ABS_MT_TOUCH_MINOR:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].radius_y_ = input.value / 2.0f;
       break;
     case ABS_MT_POSITION_X:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].x_ = input.value;
       break;
     case ABS_MT_POSITION_Y:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].y_ = input.value;
       break;
     case ABS_MT_TRACKING_ID:
-      altered_slots_.set(current_slot_);
       if (input.value < 0) {
         events_[current_slot_].type_ = ET_TOUCH_RELEASED;
       } else {
         events_[current_slot_].finger_ = input.value;
         events_[current_slot_].type_ = ET_TOUCH_PRESSED;
       }
       break;
     case ABS_MT_PRESSURE:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].pressure_ = input.value - pressure_min_;
       events_[current_slot_].pressure_ /= pressure_max_ - pressure_min_;
       break;
     case ABS_MT_SLOT:
-      if (input.value >= MAX_FINGERS) {
-        LOG(ERROR) << "multi-touch slot " << input.value
-                   << " exceeds MAX_FINGERS";
-        break;
+      if (input.value >= 0 && input.value < events_.size()) {
+        current_slot_ = input.value;
+      } else {
+        LOG(ERROR) << "invalid touch event index: " << input.value;
+        return;
       }
-      current_slot_ = input.value;
-      altered_slots_.set(current_slot_);
       break;
     default:
       DVLOG(5) << "unhandled code for EV_ABS: " << input.code;
+      return;
   }
+  events_[current_slot_].altered_ = true;
 }
 
 void TouchEventConverterEvdev::ProcessSyn(const input_event& input) {
   switch (input.code) {
     case SYN_REPORT:
       if (syn_dropped_) {
         // Have to re-initialize.
         if (Reinitialize()) {
           syn_dropped_ = false;
-          altered_slots_.reset();
+          events_.clear();
         } else {
           LOG(ERROR) << "failed to re-initialize device info";
         }
       } else {
         ReportEvents(base::TimeDelta::FromMicroseconds(
             input.time.tv_sec * 1000000 + input.time.tv_usec));
       }
       if (is_type_a_)
         current_slot_ = 0;
       break;
     case SYN_MT_REPORT:
       // For type A devices, we just get a stream of all current contacts,
       // in some arbitrary order.
-      events_[current_slot_++].type_ = ET_TOUCH_PRESSED;
+      if (events_.size() > current_slot_)
+        events_[current_slot_++].type_ = ET_TOUCH_PRESSED;

[spang, 2015/02/03 17:05:23]

if current_slot_ == size() - 1 then ++ here will put it of range.

Maybe:

events_[current_slot_] = ET_TOUCH_PRESSED;
current_slot_ = min(current_slot_ + 1, event_.size() - 1);

[achaulk, 2015/02/04 16:40:34]

Oops, good catch

       is_type_a_ = true;
       break;
     case SYN_DROPPED:
       // Some buffer has overrun. We ignore all events up to and
       // including the next SYN_REPORT.
       syn_dropped_ = true;
       break;
     default:
       NOTIMPLEMENTED() << "invalid code for EV_SYN: " << input.code;
   }
 }
 
 void TouchEventConverterEvdev::ReportEvent(int touch_id,
                                            const InProgressEvents& event,
                                            const base::TimeDelta& timestamp) {
   dispatcher_->DispatchTouchEvent(TouchEventParams(
       id_, touch_id, event.type_, gfx::PointF(event.x_, event.y_),
       gfx::Vector2dF(event.radius_x_, event.radius_y_), event.pressure_,
       timestamp));
 }
 
 void TouchEventConverterEvdev::ReportEvents(base::TimeDelta delta) {
-  for (int i = 0; i < MAX_FINGERS; i++) {
-    if (altered_slots_[i]) {
+  for (size_t i = 0; i < events_.size(); i++) {
+    if (events_[i].altered_) {
       ReportEvent(i, events_[i], delta);
 
       // Subsequent events for this finger will be touch-move until it
       // is released.
       events_[i].type_ = ET_TOUCH_MOVED;
+      events_[i].altered_ = false;
     }
   }
-  altered_slots_.reset();
 }
 
 }  // namespace ui