Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07fd0f19 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg
Browse files

Binder: Fix some valgrind errors. 

When using 64 bit binder pointers, only initializing the 32 bit
handle, in a stack allocated struct, will pass uninitialized stack
data to the kernel and other processes.

Change-Id: I3432d9d36bb251d8ddb0a863661aeb80aabb3d92
parent 87b30d04

libs/binder/IPCThreadState.cpp

+1 −0
Original line number Diff line number Diff line
@@ -904,6 +904,7 @@ status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags, 
{

    binder_transaction_data tr;



    tr.target.ptr = 0; /* Don't pass uninitialized stack data to a remote process */

    tr.target.handle = handle;

    tr.code = code;

    tr.flags = binderFlags;

libs/binder/Parcel.cpp

+3 −0
Original line number Diff line number Diff line
@@ -164,6 +164,7 @@ status_t flatten_binder(const sp<ProcessState>& /*proc*/, 
            }

            const int32_t handle = proxy ? proxy->handle() : 0;

            obj.type = BINDER_TYPE_HANDLE;

            obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */

            obj.handle = handle;

            obj.cookie = 0;

        } else {
@@ -197,6 +198,7 @@ status_t flatten_binder(const sp<ProcessState>& /*proc*/, 
                }

                const int32_t handle = proxy ? proxy->handle() : 0;

                obj.type = BINDER_TYPE_WEAK_HANDLE;

                obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */

                obj.handle = handle;

                obj.cookie = 0;

            } else {
@@ -748,6 +750,7 @@ status_t Parcel::writeFileDescriptor(int fd, bool takeOwnership) 
    flat_binder_object obj;

    obj.type = BINDER_TYPE_FD;

    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;

    obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */

    obj.handle = fd;

    obj.cookie = takeOwnership ? 1 : 0;

    return writeObject(obj, true);