Update parcel data pointer after realloc with size 0
If restartWrite is called with desired size of 0, mData will be reallocated to size 0. This frees the memory and returns a null pointer. When this happends we need to update the stored data pointer and capacity otherwise we will crash with a double free when the object is desctructed. Bug: 157066561 Test: build POC included in bug. 'adb push binderMemSafety /data/local/tmp && adb shell /data/local/tmp/binderMemSafety'. Reproduce the crash without this change, then verify no crash with this change. This is also being added to STS. Ran 'atest -p' for binder tests. Change-Id: I494e954204ee4a312739ae8600e2cf545ea452e3
Loading
Please register or sign in to comment