Loading libs/ui/GraphicBuffer.cpp +5 −1 Original line number Original line Diff line number Diff line Loading @@ -310,7 +310,11 @@ status_t GraphicBuffer::unflatten( const size_t numFds = buf[8]; const size_t numFds = buf[8]; const size_t numInts = buf[9]; const size_t numInts = buf[9]; const size_t maxNumber = UINT_MAX / sizeof(int); // Limit the maxNumber to be relatively small. The number of fds or ints // should not come close to this number, and the number itself was simply // chosen to be high enough to not cause issues and low enough to prevent // overflow problems. const size_t maxNumber = 4096; if (numFds >= maxNumber || numInts >= (maxNumber - 10)) { if (numFds >= maxNumber || numInts >= (maxNumber - 10)) { width = height = stride = format = usage = 0; width = height = stride = format = usage = 0; handle = NULL; handle = NULL; Loading Loading
libs/ui/GraphicBuffer.cpp +5 −1 Original line number Original line Diff line number Diff line Loading @@ -310,7 +310,11 @@ status_t GraphicBuffer::unflatten( const size_t numFds = buf[8]; const size_t numFds = buf[8]; const size_t numInts = buf[9]; const size_t numInts = buf[9]; const size_t maxNumber = UINT_MAX / sizeof(int); // Limit the maxNumber to be relatively small. The number of fds or ints // should not come close to this number, and the number itself was simply // chosen to be high enough to not cause issues and low enough to prevent // overflow problems. const size_t maxNumber = 4096; if (numFds >= maxNumber || numInts >= (maxNumber - 10)) { if (numFds >= maxNumber || numInts >= (maxNumber - 10)) { width = height = stride = format = usage = 0; width = height = stride = format = usage = 0; handle = NULL; handle = NULL; Loading