Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0ff545d4 authored by Christopher Tate's avatar Christopher Tate Committed by Brinly Taylor
Browse files

Correct overflow check in Parcel resize code 

Fix merge conflict into nyc-mr1-release
Bug 31929765

Change-Id: Ie27b9945f1de056624668869bdf9a5578abff467
(cherry picked from commit 65dd433f0db2fe402dc725f7012c6e26769b3224)
(cherry picked from commit b4d6b292bce7d82c93fd454078dedf5a1302b9fa)
parent 78f9ca0f

libs/binder/Parcel.cpp

+2 −2
Original line number Diff line number Diff line
@@ -553,7 +553,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
        // grow objects

        if (mObjectsCapacity < mObjectsSize + numObjects) {

            size_t newSize = ((mObjectsSize + numObjects)*3)/2;

            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

            binder_size_t *objects =

                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

            if (objects == (binder_size_t*)0) {
@@ -1113,7 +1113,7 @@ restart_write: 
    }

    if (!enoughObjects) {

        size_t newSize = ((mObjectsSize+2)*3)/2;

        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

        if (objects == NULL) return NO_MEMORY;

        mObjects = objects;