Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54826461 authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Fix null-deref crash while fuzzing 

When random parcel is sent to incidentd, AIDL service
crashes with null pointer dereference.

Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
Bug: 282963041
Change-Id: I0e0ebc479acbfd3f5e9f56b629380b5d90021f45
parent 4d3ac1d5

cmds/incidentd/src/IncidentService.cpp

+3 −0
Original line number Diff line number Diff line
@@ -513,6 +513,9 @@ status_t IncidentService::onTransact(uint32_t code, const Parcel& data, Parcel* 
            sp<IShellCallback> shellCallback = IShellCallback::asInterface(data.readStrongBinder());

            sp<IResultReceiver> resultReceiver =

                    IResultReceiver::asInterface(data.readStrongBinder());

            if (resultReceiver == nullptr) {

                return BAD_VALUE;

            }



            FILE* fin = fdopen(in, "r");

            FILE* fout = fdopen(out, "w");