Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38e2aaaa authored by Kenny Root's avatar Kenny Root Committed by Android Git Automerger
Browse files

am 5b61ad2c: Check the padded size of the read byte array 

* commit '5b61ad2c':
  Check the padded size of the read byte array
parents 7cd122a5 5b61ad2c

libs/binder/Parcel.cpp

+4 −2
Original line number Diff line number Diff line
@@ -908,7 +908,8 @@ void Parcel::remove(size_t start, size_t amt) 


status_t Parcel::read(void* outData, size_t len) const

{

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize

            && len <= PAD_SIZE(len)) {

        memcpy(outData, mData+mDataPos, len);

        mDataPos += PAD_SIZE(len);

        ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
@@ -919,7 +920,8 @@ status_t Parcel::read(void* outData, size_t len) const 


const void* Parcel::readInplace(size_t len) const

{

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize

            && len <= PAD_SIZE(len)) {

        const void* data = mData+mDataPos;

        mDataPos += PAD_SIZE(len);

        ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);