Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b61ad2c authored by Kenny Root's avatar Kenny Root
Browse files

Check the padded size of the read byte array 

Bug: 13509200
Change-Id: Id93894fcc617ec1cd4ce66921c6e1f1c3cf40b09
parent f0190bff

libs/binder/Parcel.cpp

+4 −2
Original line number Diff line number Diff line
@@ -908,7 +908,8 @@ void Parcel::remove(size_t start, size_t amt) 


status_t Parcel::read(void* outData, size_t len) const

{

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize

            && len <= PAD_SIZE(len)) {

        memcpy(outData, mData+mDataPos, len);

        mDataPos += PAD_SIZE(len);

        ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
@@ -919,7 +920,8 @@ status_t Parcel::read(void* outData, size_t len) const 


const void* Parcel::readInplace(size_t len) const

{

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {

    if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize

            && len <= PAD_SIZE(len)) {

        const void* data = mData+mDataPos;

        mDataPos += PAD_SIZE(len);

        ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);