Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6af27a83 authored by Michael Wachenschwanz's avatar Michael Wachenschwanz
Browse files

Free mObjects if no objects left to realloc on resize 

Fixes: 134168436
Test: atest CtsOsTestCases:ParcelTest#testObjectDoubleFree
Change-Id: I82e7e8c7b4206fb45b832a71d174df45edb62710
parent 0683fe79

libs/binder/Parcel.cpp

+10 −4
Original line number Diff line number Diff line
@@ -2835,11 +2835,17 @@ status_t Parcel::continueWrite(size_t desired) 
                }

                release_object(proc, *flat, this, &mOpenAshmemSize);

            }



            if (objectsSize == 0) {

                free(mObjects);

                mObjects = nullptr;

            } else {

                binder_size_t* objects =

                    (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));

                if (objects) {

                    mObjects = objects;

                }

            }

            mObjectsSize = objectsSize;

            mNextObjectHint = 0;

            mObjectsSorted = false;