Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 894ba10a authored by Casey Dahlin's avatar Casey Dahlin Committed by android-build-merger
Browse files

Fix integer overflow in unsafeReadTypedVector 

am: 65a8f07e

Change-Id: If37f6f01bfd8e7107063ce6993cf4c2b671fe99b
parents c261a17e 65a8f07e

include/binder/Parcel.h

+8 −0
Original line number Diff line number Diff line
@@ -589,8 +589,16 @@ status_t Parcel::unsafeReadTypedVector( 
        return UNEXPECTED_NULL;

    }



    if (val->max_size() < size) {

        return NO_MEMORY;

    }



    val->resize(size);



    if (val->size() < size) {

        return NO_MEMORY;

    }



    for (auto& v: *val) {

        status = (this->*read_func)(&v);