Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6cbbf851 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "binder: Tweak overflow check for readability" am: 5caafddc am:... 

Merge "binder: Tweak overflow check for readability" am: 5caafddc am: 1c60c225 am: 42b48a13 am: 7fb41657

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2106895



Change-Id: I4c6bd361f5f46438ceab15b0aa752568dd7b771f
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 91aaeb47 7fb41657

libs/binder/RpcState.cpp

+7 −10
Original line number Diff line number Diff line
@@ -493,14 +493,13 @@ status_t RpcState::transactAddress(const sp<RpcSession::RpcConnection>& connecti 
        }

    }



    LOG_ALWAYS_FATAL_IF(std::numeric_limits<int32_t>::max() - sizeof(RpcWireHeader) -

                                        sizeof(RpcWireTransaction) <

                                data.dataSize(),

    uint32_t bodySize;

    LOG_ALWAYS_FATAL_IF(__builtin_add_overflow(sizeof(RpcWireTransaction), data.dataSize(),

                                               &bodySize),

                        "Too much data %zu", data.dataSize());



    RpcWireHeader command{

            .command = RPC_COMMAND_TRANSACT,

            .bodySize = static_cast<uint32_t>(sizeof(RpcWireTransaction) + data.dataSize()),

            .bodySize = bodySize,

    };



    RpcWireTransaction transaction{
@@ -940,14 +939,12 @@ processTransactInternalTailCall: 
        replyStatus = flushExcessBinderRefs(session, addr, target);

    }



    LOG_ALWAYS_FATAL_IF(std::numeric_limits<int32_t>::max() - sizeof(RpcWireHeader) -

                                        sizeof(RpcWireReply) <

                                reply.dataSize(),

    uint32_t bodySize;

    LOG_ALWAYS_FATAL_IF(__builtin_add_overflow(sizeof(RpcWireReply), reply.dataSize(), &bodySize),

                        "Too much data for reply %zu", reply.dataSize());



    RpcWireHeader cmdReply{

            .command = RPC_COMMAND_REPLY,

            .bodySize = static_cast<uint32_t>(sizeof(RpcWireReply) + reply.dataSize()),

            .bodySize = bodySize,

    };

    RpcWireReply rpcReply{

            .status = replyStatus,