Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04c664aa authored by Christopher Tate's avatar Christopher Tate Committed by Android Git Automerger
Browse files

am 633b35b4: am 2560442a: Merge "Prevent integer overflow when calculating... 

am 633b35b4: am 2560442a: Merge "Prevent integer overflow when calculating buffer resizes" into mnc-dev

* commit '633b35b4':
  Prevent integer overflow when calculating buffer resizes
parents a393c62f 633b35b4

libs/binder/BufferedTextOutput.cpp

+4 −1
Original line number Diff line number Diff line
@@ -49,9 +49,12 @@ struct BufferedTextOutput::BufferState : public RefBase 
    

    status_t append(const char* txt, size_t len) {

        if ((len+bufferPos) > bufferSize) {

            void* b = realloc(buffer, ((len+bufferPos)*3)/2);

            size_t newSize = ((len+bufferPos)*3)/2;

            if (newSize < (len+bufferPos)) return NO_MEMORY;    // overflow

            void* b = realloc(buffer, newSize);

            if (!b) return NO_MEMORY;

            buffer = (char*)b;

            bufferSize = newSize;

        }

        memcpy(buffer+bufferPos, txt, len);

        bufferPos += len;

libs/binder/Parcel.cpp

+3 −1
Original line number Diff line number Diff line
@@ -484,7 +484,8 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
    if (numObjects > 0) {

        // grow objects

        if (mObjectsCapacity < mObjectsSize + numObjects) {

            int newSize = ((mObjectsSize + numObjects)*3)/2;

            size_t newSize = ((mObjectsSize + numObjects)*3)/2;

            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

            binder_size_t *objects =

                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

            if (objects == (binder_size_t*)0) {
@@ -1038,6 +1039,7 @@ restart_write: 
    }

    if (!enoughObjects) {

        size_t newSize = ((mObjectsSize+2)*3)/2;

        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow

        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

        if (objects == NULL) return NO_MEMORY;

        mObjects = objects;