diff options
Diffstat (limited to 'libpixelflinger/tinyutils/SharedBuffer.cpp')
-rw-r--r-- | libpixelflinger/tinyutils/SharedBuffer.cpp | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/libpixelflinger/tinyutils/SharedBuffer.cpp b/libpixelflinger/tinyutils/SharedBuffer.cpp index ef781a7..730c6d8 100644 --- a/libpixelflinger/tinyutils/SharedBuffer.cpp +++ b/libpixelflinger/tinyutils/SharedBuffer.cpp @@ -6,11 +6,15 @@ * */ +#define __STDC_LIMIT_MACROS +#include <stdint.h> #include <stdlib.h> #include <string.h> #include <cutils/atomic.h> +#define LOG_TAG "SharedBuffer" +#include <cutils/log.h> #include "tinyutils/SharedBuffer.h" // --------------------------------------------------------------------------- @@ -19,6 +23,11 @@ namespace android { SharedBuffer* SharedBuffer::alloc(size_t size) { + // Don't overflow if the combined size of the buffer / header is larger than + // size_max. + LOG_ALWAYS_FATAL_IF((size >= (SIZE_MAX - sizeof(SharedBuffer))), + "Invalid buffer size %zu", size); + SharedBuffer* sb = static_cast<SharedBuffer *>(malloc(sizeof(SharedBuffer) + size)); if (sb) { sb->mRefs = 1; @@ -45,7 +54,7 @@ SharedBuffer* SharedBuffer::edit() const memcpy(sb->data(), data(), size()); release(); } - return sb; + return sb; } SharedBuffer* SharedBuffer::editResize(size_t newSize) const @@ -53,6 +62,11 @@ SharedBuffer* SharedBuffer::editResize(size_t newSize) const if (onlyOwner()) { SharedBuffer* buf = const_cast<SharedBuffer*>(this); if (buf->mSize == newSize) return buf; + // Don't overflow if the combined size of the new buffer / header is larger than + // size_max. + LOG_ALWAYS_FATAL_IF((newSize >= (SIZE_MAX - sizeof(SharedBuffer))), + "Invalid buffer size %zu", newSize); + buf = (SharedBuffer*)realloc(buf, sizeof(SharedBuffer) + newSize); if (buf != NULL) { buf->mSize = newSize; |