Add bounds check to sensors direct channel creation am: 0eb4624b33 am: 9f58afcc4a (3edc5ea2) · Commits · e / os / android_frameworks_native-old

services/sensorservice/SensorService.cpp

+7 −1

Original line number	Original line	Diff line number	Diff line
	@@ -24,6 +24,7 @@
	#include <cutils/properties.h>		#include <cutils/properties.h>
	#include <hardware/sensors.h>		#include <hardware/sensors.h>
	#include <hardware_legacy/power.h>		#include <hardware_legacy/power.h>
			#include <log/log.h>
	#include <openssl/digest.h>		#include <openssl/digest.h>
	#include <openssl/hmac.h>		#include <openssl/hmac.h>
	#include <openssl/rand.h>		#include <openssl/rand.h>
	@@ -1093,10 +1094,15 @@ sp<ISensorEventConnection> SensorService::createSensorDirectConnection(
	// check specific to memory type		// check specific to memory type
	switch(type) {		switch(type) {
	case SENSOR_DIRECT_MEM_TYPE_ASHMEM: { // channel backed by ashmem		case SENSOR_DIRECT_MEM_TYPE_ASHMEM: { // channel backed by ashmem
			if (resource->numFds < 1) {
			ALOGE("Ashmem direct channel requires a memory region to be supplied");
			android_errorWriteLog(0x534e4554, "70986337"); // SafetyNet
			return nullptr;
			}
	int fd = resource->data[0];		int fd = resource->data[0];
	int size2 = ashmem_get_size_region(fd);		int size2 = ashmem_get_size_region(fd);
	// check size consistency		// check size consistency
	if (size2 < static_cast<int>(size)) {		if (size2 < static_cast<int64_t>(size)) {
	ALOGE("Ashmem direct channel size %" PRIu32 " greater than shared memory size %d",		ALOGE("Ashmem direct channel size %" PRIu32 " greater than shared memory size %d",
	size, size2);		size, size2);
	return nullptr;		return nullptr;