Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70b9a03d authored by Casey Dahlin's avatar Casey Dahlin Committed by android-build-merger
Browse files

Fix integer overflow in unsafeReadTypedVector am: 65a8f07e am: 894ba10a am: b7a1cc50 

am: 5fef0c6d

Change-Id: I1b75c83f3b2daaad30c42b0a3fed0add0cead5ee
parents f69a3798 5fef0c6d

include/binder/Parcel.h

+8 −0
Original line number Diff line number Diff line
@@ -589,8 +589,16 @@ status_t Parcel::unsafeReadTypedVector( 
        return UNEXPECTED_NULL;

    }



    if (val->max_size() < size) {

        return NO_MEMORY;

    }



    val->resize(size);



    if (val->size() < size) {

        return NO_MEMORY;

    }



    for (auto& v: *val) {

        status = (this->*read_func)(&v);