Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edd3e3d8 authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by Bryan Ferris
Browse files

Free mObjects if no objects left to realloc on resize 

Bug: 134168436
Bug: 133785589
Bug: 34175893
Test: atest CtsOsTestCases:ParcelTest#testObjectDoubleFree
Change-Id: I82e7e8c7b4206fb45b832a71d174df45edb62710
Merged-In: I82e7e8c7b4206fb45b832a71d174df45edb62710
parent 05fc5e04

libs/binder/Parcel.cpp

+10 −4
Original line number Diff line number Diff line
@@ -2549,11 +2549,17 @@ status_t Parcel::continueWrite(size_t desired) 
                }

                release_object(proc, *flat, this, &mOpenAshmemSize);

            }



            if (objectsSize == 0) {

                free(mObjects);

                mObjects = nullptr;

            } else {

                binder_size_t* objects =

                    (binder_size_t*)realloc(mObjects, objectsSize*sizeof(binder_size_t));

                if (objects) {

                    mObjects = objects;

                }

            }

            mObjectsSize = objectsSize;

            mNextObjectHint = 0;

            mObjectsSorted = false;