Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c8c8138 authored by Dan Austin's avatar Dan Austin Committed by Gerrit Code Review
Browse files

Merge "Benign unsigned integer overflow in Parcel"

parents 8c77ec50 48fd7b45

libs/binder/Parcel.cpp

+9 −2
Original line number Diff line number Diff line
@@ -1550,8 +1550,14 @@ void Parcel::freeDataNoInit() 
        if (mData) {

            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);

            pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

            gParcelGlobalAllocSize -= mDataCapacity;

            if (mDataCapacity <= gParcelGlobalAllocSize) {

              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;

            } else {

              gParcelGlobalAllocSize = 0;

            }

            if (gParcelGlobalAllocCount > 0) {

              gParcelGlobalAllocCount--;

            }

            pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

            free(mData);

        }
@@ -1712,6 +1718,7 @@ status_t Parcel::continueWrite(size_t desired) 
                pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

                gParcelGlobalAllocSize += desired;

                gParcelGlobalAllocSize -= mDataCapacity;

                gParcelGlobalAllocCount++;

                pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

                mData = data;

                mDataCapacity = desired;