Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6b0dfa3 authored by Steven Moreland's avatar Steven Moreland
Browse files

Parcel: free objects before realloc 

Otherwise this would try to free the objects
which have been written over in mData.

Bug: 328177618
Test: with fuzzer
Change-Id: I8929d11e3c1c193a1c36e95371b5e96e24d47ece
parent 52f0fc4d

libs/binder/Parcel.cpp

+2 −2
Original line number Diff line number Diff line
@@ -2930,14 +2930,14 @@ status_t Parcel::restartWrite(size_t desired) 
        return continueWrite(desired);

    }



    releaseObjects();



    uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);

    if (!data && desired > mDataCapacity) {

        mError = NO_MEMORY;

        return NO_MEMORY;

    }



    releaseObjects();



    if (data || desired == 0) {

        LOG_ALLOC("Parcel %p: restart from %zu to %zu capacity", this, mDataCapacity, desired);

        if (mDataCapacity > desired) {