Merge UBSan vla-bounds-not-positive fix from upstream

Bug: 315418482
Test: Treehugger
Change-Id: Ibc86b4ee4db288df0be771f007946ae7d65c01a9

4 files changed, 29 insertions, 3 deletions

diff --git a/METADATA b/METADATA
index 9f26ca1..c2fe6b5 100644
--- a/METADATA
+++ b/METADATA
@@ -6,7 +6,7 @@ third_party {
     type: GIT
     value: "https://chromium.googlesource.com/chromiumos/platform/gestures/"
   }
-  version: "d2ec17e2817001e97841fbab6da708a4183da4e1"
-  last_upgrade_date { year: 2023 month: 12 day: 4  }
+  version: "b31ef0adcaff61c045e95158cb9720543b42b531"
+  last_upgrade_date { year: 2023 month: 12 day: 13  }
   license_type: NOTICE
 }
diff --git a/include/immediate_interpreter.h b/include/immediate_interpreter.h
index 92d12a0..1be420e 100644
--- a/include/immediate_interpreter.h
+++ b/include/immediate_interpreter.h
@@ -344,6 +344,7 @@ class ImmediateInterpreter : public Interpreter, public PropertyDelegate {
   FRIEND_TEST(ImmediateInterpreterTest, ClickTest);
   FRIEND_TEST(ImmediateInterpreterTest, FlingDepthTest);
   FRIEND_TEST(ImmediateInterpreterTest, GetGesturingFingersTest);
+  FRIEND_TEST(ImmediateInterpreterTest, GetGesturingFingersWithEmptyStateTest);
   FRIEND_TEST(ImmediateInterpreterTest, PalmAtEdgeTest);
   FRIEND_TEST(ImmediateInterpreterTest, PalmReevaluateTest);
   FRIEND_TEST(ImmediateInterpreterTest, PalmTest);
diff --git a/src/immediate_interpreter.cc b/src/immediate_interpreter.cc
index 00d8b16..c1aa568 100644
--- a/src/immediate_interpreter.cc
+++ b/src/immediate_interpreter.cc
@@ -1729,6 +1729,10 @@ FingerMap ImmediateInterpreter::GetGesturingFingers(
   if (pointing_.size() <= kMaxGesturingFingers)
     return pointing_;
 
+  if (hwstate.finger_cnt <= 0) {
+    return {};
+  }
+
   const FingerState* fs[hwstate.finger_cnt];
   for (size_t i = 0; i < hwstate.finger_cnt; ++i)
     fs[i] = &hwstate.fingers[i];
diff --git a/src/immediate_interpreter_unittest.cc b/src/immediate_interpreter_unittest.cc
index 0d4b195..c7c6db2 100644
--- a/src/immediate_interpreter_unittest.cc
+++ b/src/immediate_interpreter_unittest.cc
@@ -1501,7 +1501,7 @@ TEST(ImmediateInterpreterTest, GetGesturingFingersTest) {
   TestInterpreterWrapper wrapper(&ii, &hwprops);
 
   FingerState finger_states[] = {
-    // TM, Tm, WM, Wm, Press, Orientation, X, Y, TrID
+    // TM, Tm, WM, Wm, Press, Orientation, X, Y, TrID, flags
     {0, 0, 0, 0, 1, 0, 61, 70, 91, 0},
     {0, 0, 0, 0, 1, 0, 62, 65, 92, 0},
     {0, 0, 0, 0, 1, 0, 62, 69, 93, 0},
@@ -1562,6 +1562,27 @@ TEST(ImmediateInterpreterTest, GetGesturingFingersTest) {
   EXPECT_TRUE(ids.end() != ids.find(92));
 }
 
+TEST(ImmediateInterpreterTest, GetGesturingFingersWithEmptyStateTest) {
+  ImmediateInterpreter ii(nullptr, nullptr);
+  HardwareProperties hwprops = {};
+  TestInterpreterWrapper wrapper(&ii, &hwprops);
+
+  FingerState finger_states[] = {
+    // TM, Tm, WM, Wm, Press, Orientation, X, Y, TrID, flags
+    {0, 0, 0, 0, 1, 0, 61, 70, 91, 0},
+    {0, 0, 0, 0, 1, 0, 62, 65, 92, 0},
+    {0, 0, 0, 0, 1, 0, 62, 69, 93, 0},
+    {0, 0, 0, 0, 1, 0, 62, 61, 94, 0},
+    {0, 0, 0, 0, 1, 0, 63, 80, 95, 0},
+  };
+  HardwareState five_finger_hwstate =
+      make_hwstate(200000, 0, 5, 5, &finger_states[0]);
+  HardwareState no_finger_hwstate = make_hwstate(200001, 0, 0, 0, nullptr);
+  ii.ResetSameFingersState(five_finger_hwstate);
+  ii.UpdatePointingFingers(five_finger_hwstate);
+  EXPECT_TRUE(ii.GetGesturingFingers(no_finger_hwstate).empty());
+}
+
 namespace {
 std::set<short> MkSet() {
   return std::set<short>();