Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5febeff1 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Android Git Automerger
Browse files

am 9b5c3b91: am d5a354c6: am d06f6b00: am 67903293: Fix "Binder: Make sure... 

am 9b5c3b91: am d5a354c6: am d06f6b00: am 67903293: Fix "Binder: Make sure binder objects do not overlap" to work old binder kernel interface

* commit '9b5c3b91':
  Fix "Binder: Make sure binder objects do not overlap" to work old binder kernel interface
parents fb83d846 9b5c3b91

libs/binder/Parcel.cpp

+4 −4
Original line number Original line Diff line number Diff line
@@ -1383,7 +1383,7 @@ size_t Parcel::ipcObjectsCount() const 
void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,

void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,

    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)

    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)

{

{

    binder_size_t minOffset = 0;

    size_t minOffset = 0;

    freeDataNoInit();

    freeDataNoInit();

    mError = NO_ERROR;

    mError = NO_ERROR;

    mData = const_cast<uint8_t*>(data);

    mData = const_cast<uint8_t*>(data);
@@ -1397,10 +1397,10 @@ void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, 
    mOwner = relFunc;

    mOwner = relFunc;

    mOwnerCookie = relCookie;

    mOwnerCookie = relCookie;

    for (size_t i = 0; i < mObjectsSize; i++) {

    for (size_t i = 0; i < mObjectsSize; i++) {

        binder_size_t offset = mObjects[i];

        size_t offset = mObjects[i];

        if (offset < minOffset) {

        if (offset < minOffset) {

            ALOGE("%s: bad object offset %"PRIu64" < %"PRIu64"\n",

            ALOGE("%s: bad object offset %zu < %zu\n",

                  __func__, (uint64_t)offset, (uint64_t)minOffset);

                  __func__, offset, minOffset);

            mObjectsSize = 0;

            mObjectsSize = 0;

            break;

            break;

        }

        }