diff options
| author | Christopher Tate <ctate@google.com> | 2015-05-27 17:53:02 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2015-08-14 12:03:50 -0700 |
| commit | 56710eb118c061ec39258c637e251d3765e9421d (patch) | |
| tree | a9f9f223944d8a00fa8c374dffad81a7701451a6 | |
| parent | 544b11dffcce336f3260606a5895764e3cfe6fbb (diff) | |
| download | native-56710eb118c061ec39258c637e251d3765e9421d.tar.gz | |
Disregard alleged binder entities beyond parcel boundsandroid-5.1.1_r23android-5.1.1_r18
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
(cherry picked from commit 27182be9f20f4f5b48316666429f09b9ecc1f22e)
| -rw-r--r-- | libs/binder/Parcel.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 99c934cdd4..87ce5d076e 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -411,7 +411,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) // Count objects in range for (int i = 0; i < (int) size; i++) { size_t off = objects[i]; - if ((off >= offset) && (off < offset + len)) { + if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) { if (firstIndex == -1) { firstIndex = i; } |