Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7cc5b880 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Android Git Automerger
Browse files

am e45636a8: am d437364e: am f50b9eaa: Binder: Make sure binder objects do not overlap 

* commit 'e45636a8':
  Binder: Make sure binder objects do not overlap
parents 22a5c8b2 e45636a8

libs/binder/Parcel.cpp

+12 −0
Original line number Original line Diff line number Diff line
@@ -35,6 +35,7 @@ 




#include <private/binder/binder_module.h>

#include <private/binder/binder_module.h>





#include <inttypes.h>

#include <stdio.h>

#include <stdio.h>

#include <stdlib.h>

#include <stdlib.h>

#include <stdint.h>

#include <stdint.h>
@@ -1339,6 +1340,7 @@ size_t Parcel::ipcObjectsCount() const 
void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,

void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,

    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)

    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)

{

{

    binder_size_t minOffset = 0;

    freeDataNoInit();

    freeDataNoInit();

    mError = NO_ERROR;

    mError = NO_ERROR;

    mData = const_cast<uint8_t*>(data);

    mData = const_cast<uint8_t*>(data);
@@ -1351,6 +1353,16 @@ void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, 
    mNextObjectHint = 0;

    mNextObjectHint = 0;

    mOwner = relFunc;

    mOwner = relFunc;

    mOwnerCookie = relCookie;

    mOwnerCookie = relCookie;

    for (size_t i = 0; i < mObjectsSize; i++) {

        binder_size_t offset = mObjects[i];

        if (offset < minOffset) {

            ALOGE("%s: bad object offset %"PRIu64" < %"PRIu64"\n",

                  __func__, (uint64_t)offset, (uint64_t)minOffset);

            mObjectsSize = 0;

            break;

        }

        minOffset = offset + sizeof(flat_binder_object);

    }

    scanForFds();

    scanForFds();

}

}