Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d84ff314 authored by Fabien Sanglard's avatar Fabien Sanglard
Browse files

Fix fd leak in Binder

Bug: 29982873
Test: Ran poc executable provided with bug report. After this
patch, the device is able to use the Camera after the DoS attemp.

Change-Id: I5990a25c76e9d78616caec4fc98fb5547f37a0de
parent 08dc2ef8
Loading
Loading
Loading
Loading
+7 −3
Original line number Original line Diff line number Diff line
@@ -2094,11 +2094,15 @@ status_t Parcel::read(FlattenableHelperInterface& val) const


    status_t err = NO_ERROR;
    status_t err = NO_ERROR;
    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
    for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
        fds[i] = dup(this->readFileDescriptor());
        int fd = this->readFileDescriptor();
        if (fds[i] < 0) {
        if (fd < 0 || ((fds[i] = dup(fd)) < 0)) {
            err = BAD_VALUE;
            err = BAD_VALUE;
            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
                i, fds[i], fd_count, strerror(errno));
                  i, fds[i], fd_count, strerror(fd < 0 ? -fd : errno));
            // Close all the file descriptors that were dup-ed.
            for (size_t j=0; j<i ;j++) {
                close(fds[j]);
            }
        }
        }
    }
    }