From c0b1a5b3daa6a3312fa4589a99d7c2e230ed87c2 Mon Sep 17 00:00:00 2001
From: Ameer Armaly <aarmaly@google.com>
Date: Tue, 13 Jul 2021 13:01:12 -0700
Subject: [PATCH] TouchExplorer: log malformed events instead of crashing.

Bug: 193092818
Test: atest GestureManifoldTest TouchExplorerTest AccessibilityGestureDetectorTest
Change-Id: I5aee4e253479b7d3b2cbdc573b335c6edf389eb9
---
 .../accessibility/gestures/TouchExplorer.java | 33 ++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
index e1af2c48789f..d7bc04091181 100644
--- a/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
+++ b/services/accessibility/java/com/android/server/accessibility/gestures/TouchExplorer.java
@@ -258,7 +258,12 @@ public class TouchExplorer extends BaseEventStreamTransformation
             super.onMotionEvent(event, rawEvent, policyFlags);
             return;
         }
-
+        try {
+            checkForMalformedEvent(event);
+        } catch (IllegalArgumentException e) {
+            Slog.e(LOG_TAG, "Ignoring malformed event: " + event.toString(), e);
+            return;
+        }
         if (DEBUG) {
             Slog.d(LOG_TAG, "Received event: " + event + ", policyFlags=0x"
                     + Integer.toHexString(policyFlags));
@@ -1222,6 +1227,32 @@ public class TouchExplorer extends BaseEventStreamTransformation
         }
     }
 
+    /**
+     * Checks to see whether an event is consistent with itself.
+     *
+     * @throws IllegalArgumentException in the case of a malformed event.
+     */
+    private static void checkForMalformedEvent(MotionEvent event) {
+        if (event.getPointerCount() < 0) {
+            throw new IllegalArgumentException("Invalid pointer count: " + event.getPointerCount());
+        }
+        for (int i = 0; i < event.getPointerCount(); ++i) {
+            try {
+                int pointerId = event.getPointerId(i);
+                float x = event.getX(i);
+                float y = event.getY(i);
+                if (Float.isNaN(x) || Float.isNaN(y) || x < 0.0f || y < 0.0f) {
+                    throw new IllegalArgumentException(
+                            "Invalid coordinates: (" + x + ", " + y + ")");
+                }
+            } catch (Exception e) {
+                throw new IllegalArgumentException(
+                        "Encountered exception getting details of pointer " + i + " / "
+                                + event.getPointerCount(), e);
+            }
+        }
+    }
+
     /**
      * Class for delayed sending of hover enter and move events.
      */