Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53602ffd authored by forkbomb's avatar forkbomb
Browse files

libbinder: allow devices to disable ashmem size tracking 

The addition of ashmem size tracking can lead to parcel objects
overwriting other values on the stack in old binary blobs.

Change-Id: Ida52cec851a6f9d5a57c8f9130a5875c03dcb094
parent 8c39282e

include/binder/Parcel.h

+2 −0
Original line number Diff line number Diff line
@@ -340,8 +340,10 @@ public: 
        inline void* data() { return mData; }

    };



#ifndef DISABLE_ASHMEM_TRACKING

private:

    size_t mBlobAshmemSize;

#endif



public:

    size_t getBlobAshmemSize() const;

libs/binder/Parcel.cpp

+8 −2
Original line number Diff line number Diff line
@@ -922,9 +922,9 @@ status_t Parcel::writeBlob(size_t len, bool mutableCopy, WritableBlob* outBlob) 
    ALOGV("writeBlob: write to ashmem");

    int fd = ashmem_create_region("Parcel Blob", len);

    if (fd < 0) return NO_MEMORY;



#ifndef DISABLE_ASHMEM_TRACKING

    mBlobAshmemSize += len;



#endif

    int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);

    if (result < 0) {

        status = result;
@@ -1890,7 +1890,9 @@ void Parcel::initState() 
    mFdsKnown = true;

    mAllowFds = true;

    mOwner = NULL;

#ifndef DISABLE_ASHMEM_TRACKING

    mBlobAshmemSize = 0;

#endif

}



void Parcel::scanForFds() const
@@ -1910,7 +1912,11 @@ void Parcel::scanForFds() const 


size_t Parcel::getBlobAshmemSize() const

{

#ifndef DISABLE_ASHMEM_TRACKING

    return mBlobAshmemSize;

#else

    return 0;

#endif

}



// --- Parcel::Blob ---