Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c1f9533 authored by Christopher Tate's avatar Christopher Tate Committed by Adam Seaton
Browse files

Correct overflow check in Parcel resize code 

Fix merge conflict into nyc-mr1-security-a-release
Bug 31929765

Change-Id: Ie27b9945f1de056624668869bdf9a5578abff467
(cherry picked from commit 65dd433f0db2fe402dc725f7012c6e26769b3224)
parent 675e212c

libs/binder/Parcel.cpp

+2 −2
Original line number Diff line number Diff line
@@ -548,7 +548,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
        // grow objects

        if (mObjectsCapacity < mObjectsSize + numObjects) {

            size_t newSize = ((mObjectsSize + numObjects)*3)/2;

            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

            binder_size_t *objects =

                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

            if (objects == (binder_size_t*)0) {
@@ -1342,7 +1342,7 @@ restart_write: 
    }

    if (!enoughObjects) {

        size_t newSize = ((mObjectsSize+2)*3)/2;

        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

        if (objects == NULL) return NO_MEMORY;

        mObjects = objects;