commit 2e8ca9d01ed6a64451f9d6182e4abe980cdc41f0
author Jesse Hall <jessehall@google.com> Fri Aug 21 07:41:46 2015 -0700
committer Jesse Hall <jessehall@google.com> Fri Aug 21 07:41:46 2015 -0700
tree 9223201503211d39b2f23780f4aa058e1e683593
parent 110ddef1da19c03dd5e167680d00f48e1377da9d

libagl: Fix buffer read overrun in eglCreatePbufferSurface

The code was assuming that EGL_NONE==0, which isn't true.

Bug: 23403170
Change-Id: Ic1eccdef086b4d610bd78dbb6b2ae883c91dc322

opengl/libagl/egl.cpp

diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index 980a389..7560d8f 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -1373,7 +1373,7 @@
 
     int32_t w = 0;
     int32_t h = 0;
-    while (attrib_list[0]) {
+    while (attrib_list[0] != EGL_NONE) {
         if (attrib_list[0] == EGL_WIDTH)  w = attrib_list[1];
         if (attrib_list[0] == EGL_HEIGHT) h = attrib_list[1];
         attrib_list+=2;