Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fef0c6d authored by Casey Dahlin's avatar Casey Dahlin Committed by android-build-merger
Browse files

Fix integer overflow in unsafeReadTypedVector am: 65a8f07e am: 894ba10a 

am: b7a1cc50

Change-Id: Id199d45df5b34f3415bf1754cb324bce6a7ed983
parents 97ce9228 b7a1cc50

include/binder/Parcel.h

+8 −0
Original line number Diff line number Diff line
@@ -589,8 +589,16 @@ status_t Parcel::unsafeReadTypedVector( 
        return UNEXPECTED_NULL;

    }



    if (val->max_size() < size) {

        return NO_MEMORY;

    }



    val->resize(size);



    if (val->size() < size) {

        return NO_MEMORY;

    }



    for (auto& v: *val) {

        status = (this->*read_func)(&v);