Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e567809d authored by Martijn Coenen's avatar Martijn Coenen Committed by Android (Google) Code Review
Browse files

Merge "Fix addition/overflow checks."

parents e9756fcf da2f2fd0

libs/binder/BufferedTextOutput.cpp

+2 −1
Original line number Diff line number Diff line
@@ -49,9 +49,10 @@ struct BufferedTextOutput::BufferState : public RefBase 
    }

    

    status_t append(const char* txt, size_t len) {

        if (len > SIZE_MAX - bufferPos) return NO_MEMORY; // overflow

        if ((len+bufferPos) > bufferSize) {

            if ((len + bufferPos) > SIZE_MAX / 3) return NO_MEMORY; // overflow

            size_t newSize = ((len+bufferPos)*3)/2;

            if (newSize < (len+bufferPos)) return NO_MEMORY;    // overflow

            void* b = realloc(buffer, newSize);

            if (!b) return NO_MEMORY;

            buffer = (char*)b;

libs/binder/Parcel.cpp

+8 −2
Original line number Diff line number Diff line
@@ -422,8 +422,10 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) 
        const sp<ProcessState> proc(ProcessState::self());

        // grow objects

        if (mObjectsCapacity < mObjectsSize + numObjects) {

            if ((size_t) numObjects > SIZE_MAX - mObjectsSize) return NO_MEMORY; // overflow

            if (mObjectsSize + numObjects > SIZE_MAX / 3) return NO_MEMORY; // overflow

            size_t newSize = ((mObjectsSize + numObjects)*3)/2;

            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

            if (newSize > SIZE_MAX / sizeof(binder_size_t)) return NO_MEMORY; // overflow

            binder_size_t *objects =

                (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

            if (objects == (binder_size_t*)nullptr) {
@@ -1276,8 +1278,10 @@ restart_write: 
        if (err != NO_ERROR) return err;

    }

    if (!enoughObjects) {

        if (mObjectsSize > SIZE_MAX - 2) return NO_MEMORY; // overflow

        if ((mObjectsSize + 2) > SIZE_MAX / 3) return NO_MEMORY; // overflow

        size_t newSize = ((mObjectsSize+2)*3)/2;

        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow

        if (newSize > SIZE_MAX / sizeof(binder_size_t)) return NO_MEMORY; // overflow

        binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));

        if (objects == nullptr) return NO_MEMORY;

        mObjects = objects;
@@ -2405,6 +2409,8 @@ status_t Parcel::growData(size_t len) 
        return BAD_VALUE;

    }



    if (len > SIZE_MAX - mDataSize) return NO_MEMORY; // overflow

    if (mDataSize + len > SIZE_MAX / 3) return NO_MEMORY; // overflow

    size_t newSize = ((mDataSize+len)*3)/2;

    return (newSize <= mDataSize)

            ? (status_t) NO_MEMORY