Tile event handler : read the event data only if the event is a "value changed event". LVGL sends many other event and some of them do not set the event data (global static variable) to a valid address, which may cause an invalid read. I noticed that when porting this class on RISC-V platform (BL602).

2 files changed, 11 insertions, 9 deletions

diff --git a/src/displayapp/screens/Tile.cpp b/src/displayapp/screens/Tile.cpp
index 3eb127cc..d5d6cb80 100644
--- a/src/displayapp/screens/Tile.cpp
+++ b/src/displayapp/screens/Tile.cpp
@@ -6,15 +6,17 @@ using namespace Pinetime::Applications::Screens;
 
 namespace {
   static void lv_update_task(struct _lv_task_t* task) {
-    auto user_data = static_cast<Tile*>(task->user_data);
+    auto* user_data = static_cast<Tile*>(task->user_data);
     user_data->UpdateScreen();
   }
 
   static void event_handler(lv_obj_t* obj, lv_event_t event) {
+    if (event != LV_EVENT_VALUE_CHANGED) return;
+
     Tile* screen = static_cast<Tile*>(obj->user_data);
-    uint32_t* eventDataPtr = (uint32_t*) lv_event_get_data();
+    auto* eventDataPtr = (uint32_t*) lv_event_get_data();
     uint32_t eventData = *eventDataPtr;
-    screen->OnObjectEvent(obj, event, eventData);
+    screen->OnValueChangedEvent(obj, eventData);
   }
 }
 
@@ -124,9 +126,9 @@ bool Tile::Refresh() {
   return running;
 }
 
-void Tile::OnObjectEvent(lv_obj_t* obj, lv_event_t event, uint32_t buttonId) {
-  if (event == LV_EVENT_VALUE_CHANGED) {
-    app->StartApp(apps[buttonId], DisplayApp::FullRefreshDirections::Up);
-    running = false;
-  }
+void Tile::OnValueChangedEvent(lv_obj_t* obj, uint32_t buttonId) {
+  if(obj != btnm1) return;
+
+  app->StartApp(apps[buttonId], DisplayApp::FullRefreshDirections::Up);
+  running = false;
 }
diff --git a/src/displayapp/screens/Tile.h b/src/displayapp/screens/Tile.h
index 4ebd81cd..765a8def 100644
--- a/src/displayapp/screens/Tile.h
+++ b/src/displayapp/screens/Tile.h
@@ -32,7 +32,7 @@ namespace Pinetime {
 
         bool Refresh() override;
         void UpdateScreen();
-        void OnObjectEvent(lv_obj_t* obj, lv_event_t event, uint32_t buttonId);
+        void OnValueChangedEvent(lv_obj_t* obj, uint32_t buttonId);
 
       private:
         Pinetime::Controllers::Battery& batteryController;