Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e31fd642 authored by Pablo Ceballos's avatar Pablo Ceballos Committed by android-build-merger
Browse files

Region: Detect malicious overflow in unflatten am: 1a65fccc am: fd579a51... 

Region: Detect malicious overflow in unflatten am: 1a65fccc am: fd579a51 am: 0e85f4d4 am: 0ec362e0
am: b82c6f52

Change-Id: Iae280f2d174a8144e7c9fa657cd346597658927c
parents 316c5165 b82c6f52

libs/ui/Region.cpp

+5 −0
Original line number Original line Diff line number Diff line
@@ -796,6 +796,11 @@ status_t Region::unflatten(void const* buffer, size_t size) { 
        return NO_MEMORY;

        return NO_MEMORY;

    }

    }





    if (numRects > (UINT32_MAX / sizeof(Rect))) {

        android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);

        return NO_MEMORY;

    }



    Region result;

    Region result;

    result.mStorage.clear();

    result.mStorage.clear();

    for (size_t r = 0; r < numRects; ++r) {

    for (size_t r = 0; r < numRects; ++r) {