Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d84ff314 authored by Fabien Sanglard's avatar Fabien Sanglard
Browse files

Fix fd leak in Binder 

Bug: 29982873
Test: Ran poc executable provided with bug report. After this
patch, the device is able to use the Camera after the DoS attemp.

Change-Id: I5990a25c76e9d78616caec4fc98fb5547f37a0de
parent 08dc2ef8

libs/binder/Parcel.cpp

+7 −3
Original line number Original line Diff line number Diff line
@@ -2094,11 +2094,15 @@ status_t Parcel::read(FlattenableHelperInterface& val) const 




    status_t err = NO_ERROR;

    status_t err = NO_ERROR;

    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {

    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {

        fds[i] = dup(this->readFileDescriptor());

        int fd = this->readFileDescriptor();

        if (fds[i] < 0) {

        if (fd < 0 || ((fds[i] = dup(fd)) < 0)) {

            err = BAD_VALUE;

            err = BAD_VALUE;

            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",

            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",

                i, fds[i], fd_count, strerror(errno));

                  i, fds[i], fd_count, strerror(fd < 0 ? -fd : errno));

            // Close all the file descriptors that were dup-ed.

            for (size_t j=0; j<i ;j++) {

                close(fds[j]);

            }

        }

        }

    }

    }