From a52d9ecd574f9ab6e956c83c3b97030017532b25 Mon Sep 17 00:00:00 2001 From: HeroBuxx Date: Tue, 21 Jul 2026 19:05:35 +0000 Subject: [PATCH] hwcomposer: Prevent null pointer dereference on layer buffer handle Signed-off-by: HeroBuxx --- hwcomposer/hwcomposer.cpp | 3 +++ hwcomposer/modes/waydroid_mode_impl.h | 10 ++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/hwcomposer/hwcomposer.cpp b/hwcomposer/hwcomposer.cpp index ad50a9b9..674164a9 100644 --- a/hwcomposer/hwcomposer.cpp +++ b/hwcomposer/hwcomposer.cpp @@ -101,6 +101,9 @@ namespace { } buffer *get_wl_buffer(waydroid_hwc_composer_device_1 *pdev, hwc_layer_1_t *layer, size_t pos) { + if (!layer || !layer->handle) { + return nullptr; + } const auto& gralloc_handler = pdev->gralloc_handler; auto metadata = gralloc_handler.get_buffer_metadata(pdev->display, layer, pos); if (!metadata.format) { diff --git a/hwcomposer/modes/waydroid_mode_impl.h b/hwcomposer/modes/waydroid_mode_impl.h index 000b3880..4165aa1a 100644 --- a/hwcomposer/modes/waydroid_mode_impl.h +++ b/hwcomposer/modes/waydroid_mode_impl.h @@ -158,10 +158,12 @@ class non_compositing_window_mode : public virtual waydroid_mode { */ int res = 0; if (i == m_draw_framebuffer_at) { - assert(m_framebuffer_target->handle); - window *window = derived()->get_window(pdev); - - res = apply_hwc_layer_to_window(pdev, m_framebuffer_target, m_framebuffer_target_index, window); + if (m_framebuffer_target && m_framebuffer_target->handle) { + window *window = derived()->get_window(pdev); + res = apply_hwc_layer_to_window(pdev, m_framebuffer_target, m_framebuffer_target_index, window); + } else { + ALOGW("m_framebuffer_target is not ready or has null handle"); + } } // The acquireFenceFd of HWC_FRAMEBUFFER_TARGET is closed in apply_hwc_layer_to_window