diff options
| author | Chih-Wei Huang <cwhuang@linux.org.tw> | 2016-09-07 13:51:08 +0800 |
|---|---|---|
| committer | Chih-Wei Huang <cwhuang@linux.org.tw> | 2016-09-07 13:51:08 +0800 |
| commit | 758c4603db85a58c4c5b4a328bbf4cffdf113056 (patch) | |
| tree | ac2292624eb9faefb8cd0c1b3e13576242131f2e | |
| parent | 239d4dec6abeca7a80bc2825852586ce3500a79b (diff) | |
| parent | 1ecb999624165ea2a9cf5e16b3f7e93358d503d6 (diff) | |
| download | frameworks_native-android-x86-6.0-r1.zip frameworks_native-android-x86-6.0-r1.tar.gz frameworks_native-android-x86-6.0-r1.tar.bz2 | |
Merge tag 'android-6.0.1_r66' into marshmallow-x86android-x86-6.0-r1
Android 6.0.1 release 66
| -rw-r--r-- | libs/ui/Region.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp index 3810da4..cfed7a9 100644 --- a/libs/ui/Region.cpp +++ b/libs/ui/Region.cpp @@ -795,6 +795,11 @@ status_t Region::unflatten(void const* buffer, size_t size) { return NO_MEMORY; } + if (numRects > (UINT32_MAX / sizeof(Rect))) { + android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0); + return NO_MEMORY; + } + Region result; result.mStorage.clear(); for (size_t r = 0; r < numRects; ++r) { |