Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 48fd7b45 authored by Dan Austin's avatar Dan Austin
Browse files

Benign unsigned integer overflow in Parcel 

The realloc case in continueWrite did not update the
gParcelGlobalAllocCount value when an allocation occurred.

In addition, there are conditions that could cause the
gParcelGlobalAllocCount value to be decremented below 0, resulting
in a benign unsigned integer overflow that can cause corrupted values
to be returned through system profiling mechanisms.

BUG: 23972600
Change-Id: Ibe07db91a811a04b486760eb78d81c926ba8503d
parent bf04509f

libs/binder/Parcel.cpp

+9 −2
Original line number Diff line number Diff line
@@ -1550,8 +1550,14 @@ void Parcel::freeDataNoInit() 
        if (mData) {

            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);

            pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

            gParcelGlobalAllocSize -= mDataCapacity;

            if (mDataCapacity <= gParcelGlobalAllocSize) {

              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;

            } else {

              gParcelGlobalAllocSize = 0;

            }

            if (gParcelGlobalAllocCount > 0) {

              gParcelGlobalAllocCount--;

            }

            pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

            free(mData);

        }
@@ -1712,6 +1718,7 @@ status_t Parcel::continueWrite(size_t desired) 
                pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

                gParcelGlobalAllocSize += desired;

                gParcelGlobalAllocSize -= mDataCapacity;

                gParcelGlobalAllocCount++;

                pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

                mData = data;

                mDataCapacity = desired;