commit 3ca99f6cb8ffbe19c7ef5409f3dac18ea0c254bd
author Doug Zongker <dougz@google.com> Fri May 16 14:58:32 2014 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Fri May 16 14:58:33 2014 +0000
tree b0e672cc873eba3b530132f139eb77e4b31661c6
parent d27aa76a6ff6436cfb8340bf3d04aba186cc4de1
parent 4aa12dd0decafb139239779ab38e6ffda23109ab

Merge "fix vulnerability in bspatch"

minui/graphics_fbdev.c

diff --git a/minui/graphics_fbdev.c b/minui/graphics_fbdev.c
index bb91975..a91ea87 100644
--- a/minui/graphics_fbdev.c
+++ b/minui/graphics_fbdev.c
@@ -184,8 +184,21 @@
         set_displayed_framebuffer(1-displayed_buffer);
     } else {
         // Copy from the in-memory surface to the framebuffer.
+
+#if defined(RECOVERY_BGRA)
+        unsigned int idx;
+        unsigned char* ucfb_vaddr = (unsigned char*)gr_framebuffer[0].data;
+        unsigned char* ucbuffer_vaddr = (unsigned char*)gr_draw->data;
+        for (idx = 0 ; idx < (gr_draw->height * gr_draw->row_bytes); idx += 4) {
+            ucfb_vaddr[idx    ] = ucbuffer_vaddr[idx + 2];
+            ucfb_vaddr[idx + 1] = ucbuffer_vaddr[idx + 1];
+            ucfb_vaddr[idx + 2] = ucbuffer_vaddr[idx    ];
+            ucfb_vaddr[idx + 3] = ucbuffer_vaddr[idx + 3];
+        }
+#else
         memcpy(gr_framebuffer[0].data, gr_draw->data,
                gr_draw->height * gr_draw->row_bytes);
+#endif
     }
     return gr_draw;
 }

screen_ui.cpp

diff --git a/screen_ui.cpp b/screen_ui.cpp
index 656f724..7826693 100644
--- a/screen_ui.cpp
+++ b/screen_ui.cpp
@@ -75,6 +75,8 @@
     for (int i = 0; i < 5; i++)
         backgroundIcon[i] = NULL;
 
+    memset(text, 0, sizeof(text));
+
     pthread_mutex_init(&updateMutex, NULL);
     self = this;
 }