Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 809e978b authored by Chris Tate's avatar Chris Tate Committed by Android (Google) Code Review
Browse files

Merge "Correct overflow check in Parcel resize code"

parents 4ebec991 44235112

libs/binder/Parcel.cpp

+2 −2
Original line number Diff line number Diff line
@@ -514,7 +514,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
        // grow objects

        if (mObjectsCapacity < mObjectsSize + numObjects) {

            size_t newSize = ((mObjectsSize + numObjects)*3)/2;

            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

            binder_size_t *objects =

                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

            if (objects == (binder_size_t*)0) {
@@ -1314,7 +1314,7 @@ restart_write: 
    }

    if (!enoughObjects) {

        size_t newSize = ((mObjectsSize+2)*3)/2;

        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

        if (objects == NULL) return NO_MEMORY;

        mObjects = objects;