Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7a1cc50 authored by Casey Dahlin's avatar Casey Dahlin Committed by android-build-merger
Browse files

Fix integer overflow in unsafeReadTypedVector am: 65a8f07e 

am: 894ba10a

Change-Id: If93da0dbcbf78ea65e3ac950c5539861587526bb
parents ce40ad24 894ba10a

include/binder/Parcel.h

+8 −0
Original line number Diff line number Diff line
@@ -589,8 +589,16 @@ status_t Parcel::unsafeReadTypedVector( 
        return UNEXPECTED_NULL;

    }



    if (val->max_size() < size) {

        return NO_MEMORY;

    }



    val->resize(size);



    if (val->size() < size) {

        return NO_MEMORY;

    }



    for (auto& v: *val) {

        status = (this->*read_func)(&v);