Merge "Fix integer overflow in unsafeReadTypedVector" into nyc-dev (e81a4f15) · Commits · e / os / platform_frameworks_native

include/binder/Parcel.h

+8 −0

Original line number	Original line	Diff line number	Diff line
	@@ -589,8 +589,16 @@ status_t Parcel::unsafeReadTypedVector(
	return UNEXPECTED_NULL;		return UNEXPECTED_NULL;
	}		}

			if (val->max_size() < size) {
			return NO_MEMORY;
			}

	val->resize(size);		val->resize(size);

			if (val->size() < size) {
			return NO_MEMORY;
			}

	for (auto& v: *val) {		for (auto& v: *val) {
	status = (this->*read_func)(&v);		status = (this->*read_func)(&v);