Fix for corruption when numFds or numInts is too large. (e6f7a44e) · Commits · e / devices / smdk4412 / android_frameworks_native

libs/ui/GraphicBuffer.cpp

+16 −1

Original line number	Original line	Diff line number	Diff line
	@@ -250,10 +250,19 @@ status_t GraphicBuffer::unflatten(void const* buffer, size_t size,
	const size_t numFds = buf[6];		const size_t numFds = buf[6];
	const size_t numInts = buf[7];		const size_t numInts = buf[7];

			const size_t maxNumber = UINT_MAX / sizeof(int);
			if (numFds >= maxNumber \|\| numInts >= (maxNumber - 10)) {
			width = height = stride = format = usage = 0;
			handle = NULL;
			ALOGE("unflatten: numFds or numInts is too large: %d, %d",
			numFds, numInts);
			return BAD_VALUE;
			}

	const size_t sizeNeeded = (8 + numInts) * sizeof(int);		const size_t sizeNeeded = (8 + numInts) * sizeof(int);
	if (size < sizeNeeded) return NO_MEMORY;		if (size < sizeNeeded) return NO_MEMORY;

	size_t fdCountNeeded = 0;		size_t fdCountNeeded = numFds;
	if (count < fdCountNeeded) return NO_MEMORY;		if (count < fdCountNeeded) return NO_MEMORY;

	if (handle) {		if (handle) {
	@@ -268,6 +277,12 @@ status_t GraphicBuffer::unflatten(void const* buffer, size_t size,
	format = buf[4];		format = buf[4];
	usage = buf[5];		usage = buf[5];
	native_handle* h = native_handle_create(numFds, numInts);		native_handle* h = native_handle_create(numFds, numInts);
			if (!h) {
			width = height = stride = format = usage = 0;
			handle = NULL;
			ALOGE("unflatten: native_handle_create failed");
			return NO_MEMORY;
			}
	memcpy(h->data, fds, numFds*sizeof(int));		memcpy(h->data, fds, numFds*sizeof(int));
	memcpy(h->data + numFds, &buf[8], numInts*sizeof(int));		memcpy(h->data + numFds, &buf[8], numInts*sizeof(int));
	handle = h;		handle = h;