summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdam Lesinski <adamlesinski@google.com>2015-05-12 17:35:48 -0700
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-10-18 20:58:02 +0200
commit0d46d72ec922f94d8d5b9f476a91e5be46956824 (patch)
tree3c777cef85a3cba245c0a6262e1772ca01795ea9
parent3aa2524725d696fcf3cef520a9f8f5c42e57a668 (diff)
downloadframeworks_native-0d46d72ec922f94d8d5b9f476a91e5be46956824.zip
frameworks_native-0d46d72ec922f94d8d5b9f476a91e5be46956824.tar.gz
frameworks_native-0d46d72ec922f94d8d5b9f476a91e5be46956824.tar.bz2
Verify that the native handle was created
The inputs to native_handle_create can cause an overflowed allocation, so check the return value of native_handle_create before accessing the memory it returns. Bug:19334482 Change-Id: I1f489382776c2a1390793a79dc27ea17baa9b2a2 (cherry picked from commit eaac99a7172da52a76ba48c26413778a74951b1a) Tested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
-rw-r--r--libs/binder/Parcel.cpp4
1 files changed, 4 insertions, 0 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index dc848cb..b3b1c80 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1077,6 +1077,10 @@ native_handle* Parcel::readNativeHandle() const
if (err != NO_ERROR) return 0;
native_handle* h = native_handle_create(numFds, numInts);
+ if (!h) {
+ return 0;
+ }
+
for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
h->data[i] = dup(readFileDescriptor());
if (h->data[i] < 0) err = BAD_VALUE;