Commit 52e03def authored Sep 15, 2016 by Linux Build Service Account

Promotion of android-framework.lnx.2.0-00009.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
1059112   Ib6e1cb8ae279010c5e9960aaa03513f55b7d873b   Region: Detect malicious overflow in unflatten

Change-Id: Id16b593df4cb84d2a8f280b129304a4bbaccb905
CRs-Fixed: 1059112

parents 5caf125f 5b11e147

libs/ui/Region.cpp

+5 −0

Original line number	Diff line number	Diff line
		@@ -795,6 +795,11 @@ status_t Region::unflatten(void const* buffer, size_t size) {
		return NO_MEMORY;
		}

		if (numRects > (UINT32_MAX / sizeof(Rect))) {
		android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
		return NO_MEMORY;
		}

		Region result;
		result.mStorage.clear();
		for (size_t r = 0; r < numRects; ++r) {