Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cab0fd7 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg
Browse files

Binder: Make sure binder objects do not overlap 

Fixes crashing part of bug 11355082.
The driver still leaks references.

Change-Id: Ibc6a63b151c1fc1f7666237f25255ba781e02071
parent d1c87d37

libs/binder/Parcel.cpp

+12 −0
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 


#include <private/binder/binder_module.h>



#include <inttypes.h>

#include <stdio.h>

#include <stdlib.h>

#include <stdint.h>
@@ -1342,6 +1343,7 @@ size_t Parcel::ipcObjectsCount() const 
void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,

    const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)

{

    binder_size_t minOffset = 0;

    freeDataNoInit();

    mError = NO_ERROR;

    mData = const_cast<uint8_t*>(data);
@@ -1354,6 +1356,16 @@ void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, 
    mNextObjectHint = 0;

    mOwner = relFunc;

    mOwnerCookie = relCookie;

    for (size_t i = 0; i < mObjectsSize; i++) {

        binder_size_t offset = mObjects[i];

        if (offset < minOffset) {

            ALOGE("%s: bad object offset %"PRIu64" < %"PRIu64"\n",

                  __func__, (uint64_t)offset, (uint64_t)minOffset);

            mObjectsSize = 0;

            break;

        }

        minOffset = offset + sizeof(flat_binder_object);

    }

    scanForFds();

}