Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 39617184 authored by Pawan Wagh's avatar Pawan Wagh
Browse files

Use actual consumed buffer length to call AParcel_unmarshal 

Test: m binder_parcel_fuzzer &&
out/host/linux-x86/fuzz/x86_64/binder_parcel_fuzzer/binder_parcel_fuzzer
Bug: 264746958

Change-Id: I379d04b0e25d5f9f475352abb9a078542cb0eb5d
parent 4cd03732

libs/binder/tests/parcel_fuzzer/binder_ndk.cpp

+2 −1
Original line number Diff line number Diff line
@@ -213,8 +213,9 @@ std::vector<ParcelRead<NdkParcelAdapter>> BINDER_NDK_PARCEL_READ_FUNCTIONS{ 
            size_t len = provider.ConsumeIntegralInRange<size_t>(0, provider.remaining_bytes());

            std::vector<uint8_t> parcelData = provider.ConsumeBytes<uint8_t>(len);

            const uint8_t* buffer = parcelData.data();

            const size_t bufferLen = parcelData.size();

            NdkParcelAdapter adapter;

            binder_status_t status = AParcel_unmarshal(adapter.aParcel(), buffer, len);

            binder_status_t status = AParcel_unmarshal(adapter.aParcel(), buffer, bufferLen);

            FUZZ_LOG() << "status: " << status;

        },