Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1b8a2f82 authored by Christopher Tate's avatar Christopher Tate Committed by Christopher Hocutt
Browse files

Disregard alleged binder entities beyond parcel bounds 

When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.

Bug 17312693

Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
(cherry picked from commit 27182be9)
parent 861c3f56

libs/binder/Parcel.cpp

+1 −1
Original line number Original line Diff line number Diff line
@@ -390,7 +390,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
    // Count objects in range

    // Count objects in range

    for (int i = 0; i < (int) size; i++) {

    for (int i = 0; i < (int) size; i++) {

        size_t off = objects[i];

        size_t off = objects[i];

        if ((off >= offset) && (off < offset + len)) {

        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {

            if (firstIndex == -1) {

            if (firstIndex == -1) {

                firstIndex = i;

                firstIndex = i;

            }

            }