Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5a247775 authored by Devin Moore's avatar Devin Moore
Browse files

Check mDataPos to see if the Parcel needs to grow 

Flag: EXEMPT bug fix
Ignore-AOSP-First: security fix
Test: atest binderUnitTest
Bug: 399155883
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f0b1c904a607f4dea4f35e3e9bc53e25f059f50e)
Merged-In: I38b755ca3381cfca3300292873f763823fbf169b
Change-Id: I38b755ca3381cfca3300292873f763823fbf169b
parent 4d2905fd

libs/binder/Parcel.cpp

+1 −1
Original line number Diff line number Diff line
@@ -493,7 +493,7 @@ status_t Parcel::appendFrom(const Parcel* parcel, size_t offset, size_t len) { 
        return BAD_VALUE;

    }



    if ((mDataSize+len) > mDataCapacity) {

    if ((mDataPos + len) > mDataCapacity) {

        // grow data

        err = growData(len);

        if (err != NO_ERROR) {

libs/binder/tests/binderParcelUnitTest.cpp

+11 −0
Original line number Diff line number Diff line
@@ -112,6 +112,17 @@ TEST(Parcel, DebugReadAllFds) { 
    EXPECT_EQ(ret[1], STDIN_FILENO);

}



TEST(Parcel, AppendWithBadDataPos) {

    Parcel p1;

    p1.writeInt32(1);

    p1.writeInt32(1);

    Parcel p2;

    p2.setDataCapacity(8);

    p2.setDataPosition(10000);



    EXPECT_EQ(android::BAD_VALUE, p2.appendFrom(&p1, 0, 8));

}



// Tests a second operation results in a parcel at the same location as it

// started.

void parcelOpSameLength(const std::function<void(Parcel*)>& a, const std::function<void(Parcel*)>& b) {