Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ffcb009 authored by Dan Austin's avatar Dan Austin Committed by Android Git Automerger
Browse files

am 0823223c: am f0f131f3: am 6c8c8138: Merge "Benign unsigned integer overflow in Parcel" 

* commit '0823223c':
  Benign unsigned integer overflow in Parcel
parents 4107f8fc 0823223c

libs/binder/Parcel.cpp

+9 −2
Original line number Diff line number Diff line
@@ -1645,8 +1645,14 @@ void Parcel::freeDataNoInit() 
        if (mData) {

            LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);

            pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

            gParcelGlobalAllocSize -= mDataCapacity;

            if (mDataCapacity <= gParcelGlobalAllocSize) {

              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;

            } else {

              gParcelGlobalAllocSize = 0;

            }

            if (gParcelGlobalAllocCount > 0) {

              gParcelGlobalAllocCount--;

            }

            pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

            free(mData);

        }
@@ -1825,6 +1831,7 @@ status_t Parcel::continueWrite(size_t desired) 
                pthread_mutex_lock(&gParcelGlobalAllocSizeLock);

                gParcelGlobalAllocSize += desired;

                gParcelGlobalAllocSize -= mDataCapacity;

                gParcelGlobalAllocCount++;

                pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);

                mData = data;

                mDataCapacity = desired;