Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9180d6f8 authored by Steven Moreland's avatar Steven Moreland Committed by Automerger Merge Worker
Browse files

libbinder: Parcel: grow rejects large data pos am: 0db4fced am: 788803b5... 

libbinder: Parcel: grow rejects large data pos am: 0db4fced am: 788803b5 am: 009229d9 am: abfcdc86 am: e95795fd

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/29918554



Change-Id: I82425115c33ee8bce7b5292859e0d7571f5e51a3
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents e32c1ab2 e95795fd

libs/binder/Parcel.cpp

+8 −0
Original line number Diff line number Diff line
@@ -2775,6 +2775,14 @@ status_t Parcel::growData(size_t len) 
        return BAD_VALUE;

    }



    if (mDataPos > mDataSize) {

        // b/370831157 - this case used to abort. We also don't expect mDataPos < mDataSize, but

        // this would only waste a bit of memory, so it's okay.

        ALOGE("growData only expected at the end of a Parcel. pos: %zu, size: %zu, capacity: %zu",

              mDataPos, len, mDataCapacity);

        return BAD_VALUE;

    }



    if (len > SIZE_MAX - mDataSize) return NO_MEMORY; // overflow

    if (mDataSize + len > SIZE_MAX / 3) return NO_MEMORY; // overflow

    size_t newSize = ((mDataSize+len)*3)/2;