Seeing crashes likely from negative touch indexes, check for them

ui/events/ozone/evdev/touch_event_converter_evdev.cc

Index: ui/events/ozone/evdev/touch_event_converter_evdev.cc
diff --git a/ui/events/ozone/evdev/touch_event_converter_evdev.cc b/ui/events/ozone/evdev/touch_event_converter_evdev.cc
index 3cca7ac012a268c59fbb9c2e20ccdf2c056c8967..d8aff99c0f3273692e84f538aba430b997f2b555 100644
--- a/ui/events/ozone/evdev/touch_event_converter_evdev.cc
+++ b/ui/events/ozone/evdev/touch_event_converter_evdev.cc
@@ -60,7 +60,8 @@ void GetTouchCalibration(TouchCalibration* cal) {
 namespace ui {
 
 TouchEventConverterEvdev::InProgressEvents::InProgressEvents()
-    : x_(0),
+    : altered_(false),
+      x_(0),
       y_(0),
       id_(-1),
       finger_(-1),
@@ -170,10 +171,6 @@ void TouchEventConverterEvdev::ProcessInputEvent(const input_event& input) {
   } else if(syn_dropped_) {
     // Do nothing. This branch indicates we have lost sync with the driver.
   } else if (input.type == EV_ABS) {
-    if (current_slot_ >= MAX_FINGERS) {
-      LOG(ERROR) << "too many touch events: " << current_slot_;
-      return;
-    }
     ProcessAbs(input);
   } else if (input.type == EV_KEY) {
     switch (input.code) {
@@ -188,28 +185,25 @@ void TouchEventConverterEvdev::ProcessInputEvent(const input_event& input) {
 }
 
 void TouchEventConverterEvdev::ProcessAbs(const input_event& input) {
+  if (events_.size() <= current_slot_)
+    events_.resize(current_slot_ + 1);
   switch (input.code) {
     case ABS_MT_TOUCH_MAJOR:
-      altered_slots_.set(current_slot_);
       // TODO(spang): If we have all of major, minor, and orientation,
       // we can scale the ellipse correctly. However on the Pixel we get
       // neither minor nor orientation, so this is all we can do.
       events_[current_slot_].radius_x_ = input.value / 2.0f;
       break;
     case ABS_MT_TOUCH_MINOR:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].radius_y_ = input.value / 2.0f;
       break;
     case ABS_MT_POSITION_X:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].x_ = input.value;
       break;
     case ABS_MT_POSITION_Y:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].y_ = input.value;
       break;
     case ABS_MT_TRACKING_ID:
-      altered_slots_.set(current_slot_);
       if (input.value < 0) {
         events_[current_slot_].type_ = ET_TOUCH_RELEASED;
       } else {
@@ -218,22 +212,22 @@ void TouchEventConverterEvdev::ProcessAbs(const input_event& input) {
       }
       break;
     case ABS_MT_PRESSURE:
-      altered_slots_.set(current_slot_);
       events_[current_slot_].pressure_ = input.value - pressure_min_;
       events_[current_slot_].pressure_ /= pressure_max_ - pressure_min_;
       break;
     case ABS_MT_SLOT:
-      if (input.value >= MAX_FINGERS) {
-        LOG(ERROR) << "multi-touch slot " << input.value
-                   << " exceeds MAX_FINGERS";
-        break;
+      if (input.value >= 0 && input.value < MAX_FINGERS) {
+        current_slot_ = input.value;
+      } else {
+        LOG(ERROR) << "invalid touch event index: " << input.value;
+        return;
       }
-      current_slot_ = input.value;
-      altered_slots_.set(current_slot_);
       break;
     default:
       DVLOG(5) << "unhandled code for EV_ABS: " << input.code;
+      return;
   }
+  events_[current_slot_].altered_ = true;

[spang, 2015/02/02 22:09:42]

ABS_VOLUME or something like that shouldn't generate a touch event. So unless
you filter for ABS_MT ahead of time I think this was better before (set for
codes that changed MT state).

[achaulk, 2015/02/03 16:51:49]

The default action returns early now

 }
 
 void TouchEventConverterEvdev::ProcessSyn(const input_event& input) {
@@ -243,7 +237,7 @@ void TouchEventConverterEvdev::ProcessSyn(const input_event& input) {
         // Have to re-initialize.
         if (Reinitialize()) {
           syn_dropped_ = false;
-          altered_slots_.reset();
+          events_.clear();
         } else {
           LOG(ERROR) << "failed to re-initialize device info";
         }
@@ -257,6 +251,8 @@ void TouchEventConverterEvdev::ProcessSyn(const input_event& input) {
     case SYN_MT_REPORT:
       // For type A devices, we just get a stream of all current contacts,
       // in some arbitrary order.
+      if (events_.size() <= current_slot_ + 1)
+        events_.resize(current_slot_ + 2);
       events_[current_slot_++].type_ = ET_TOUCH_PRESSED;
       is_type_a_ = true;
       break;
@@ -280,16 +276,16 @@ void TouchEventConverterEvdev::ReportEvent(int touch_id,
 }
 
 void TouchEventConverterEvdev::ReportEvents(base::TimeDelta delta) {
-  for (int i = 0; i < MAX_FINGERS; i++) {
-    if (altered_slots_[i]) {
+  for (size_t i = 0; i < events_.size(); i++) {
+    if (events_[i].altered_) {
       ReportEvent(i, events_[i], delta);
 
       // Subsequent events for this finger will be touch-move until it
       // is released.
       events_[i].type_ = ET_TOUCH_MOVED;
+      events_[i].altered_ = false;
     }
   }
-  altered_slots_.reset();
 }
 
 }  // namespace ui