e_comp_wl_capture: fix crash of accessing invalid tbm_surface

Change-Id: Ib2ff1f3d7fe39e33c90ac8f59813eac340c6fea1

diff --git a/src/bin/e_comp_wl_capture.c b/src/bin/e_comp_wl_capture.c
index 3ef728c..ab9ab99 100644 (file)
--- a/src/bin/e_comp_wl_capture.c
+++ b/src/bin/e_comp_wl_capture.c
@@ -1455,6 +1455,41 @@ end:
    _e_capture_client_save_thread_data_free(td);
 }
 
+static Eina_Bool
+_e_capture_client_tbm_surface_valid_check(tbm_surface_h tsurface)
+{
+   tbm_surface_info_s info;
+   tbm_surface_error_e ret;
+   tbm_bo bo;
+   int bo_size;
+
+   ret = tbm_surface_get_info(tsurface, &info);
+   EINA_SAFETY_ON_FALSE_RETURN_VAL(ret == TBM_SURFACE_ERROR_NONE, EINA_FALSE);
+
+   if ((info.format != TBM_FORMAT_XRGB8888) &&
+       (info.format != TBM_FORMAT_ARGB8888) &&
+       (info.format != TBM_FORMAT_XBGR8888) &&
+       (info.format != TBM_FORMAT_ABGR8888))
+     {
+        ERR("Invalid tbm_surface format(%d)", info.format);
+        return EINA_FALSE;
+     }
+
+   bo = tbm_surface_internal_get_bo(tsurface, 0);
+   EINA_SAFETY_ON_NULL_RETURN_VAL(bo, EINA_FALSE);
+
+   bo_size = tbm_bo_size(bo);
+   EINA_SAFETY_ON_FALSE_RETURN_VAL(bo_size > 0, EINA_FALSE);
+
+   if (bo_size < info.size)
+     {
+        ERR("Invalid bo size(%d) surface size(%u)", bo_size, info.size);
+        return EINA_FALSE;
+     }
+
+   return EINA_TRUE;
+}
+
 /* Stop capture job when the window is uniconified while capturing
  * on another thread.
  *
@@ -1530,6 +1565,7 @@ _e_capture_client_save(E_Capture_Client *ecc,
       case E_COMP_WL_BUFFER_TYPE_VIDEO:
          tbm_surface = wayland_tbm_server_get_surface(e_comp_wl->tbm.server, buffer->resource);
          if (!tbm_surface) goto end;
+         if (!_e_capture_client_tbm_surface_valid_check(tbm_surface)) goto end;
 
          td->tbm_surface = e_comp_wl_tbm_capturable_buffer_get(tbm_surface);
          if (!td->tbm_surface) goto end;
@@ -1537,6 +1573,7 @@ _e_capture_client_save(E_Capture_Client *ecc,
       case E_COMP_WL_BUFFER_TYPE_TBM:
          tbm_surface = buffer->tbm_surface;
          if (!tbm_surface) goto end;
+         if (!_e_capture_client_tbm_surface_valid_check(tbm_surface)) goto end;
 
          td->tbm_surface = e_comp_wl_tbm_capturable_buffer_get(tbm_surface);
          if (!td->tbm_surface) goto end;