Unverified Commit ac914576 authored Dec 03, 2018 by Kevin F. Haggerty

Merge tag 'android-8.1.0_r52' into staging/lineage-15.1_merge-android-8.1.0_r52

Android 8.1.0 release 52

* tag 'android-8.1.0_r52':
  libui: add boundary check to GraphicBuffer::unflatten
  Don't pad before calling writeInPlace().
  Increment when attempting to read protected Parcel Data
  Disallow reading object data from Parcels with non-object reads

Change-Id: I59cee11ce14f823170fbb5e29877b9472231a981

parents 5f0b3504 a5c43d50

libs/ui/GraphicBuffer.cpp

+4 −0

Original line number	Diff line number	Diff line
		@@ -372,6 +372,10 @@ status_t GraphicBuffer::flatten(void& buffer, size_t& size, int& fds, size_t&

		status_t GraphicBuffer::unflatten(
		void const& buffer, size_t& size, int const& fds, size_t& count) {
		if (size < 12 * sizeof(int)) {
		android_errorWriteLog(0x534e4554, "114223584");
		return NO_MEMORY;
		}

		int const* buf = static_cast<int const*>(buffer);