diff options
| author | Devin Moore <devinmoore@google.com> | 2023-02-17 17:12:46 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-03-28 18:43:41 +0000 |
| commit | fb4585b3dc8e5015dc91469ae004337601172aa9 (patch) | |
| tree | af1cf60d2681391d72fae5ea76db391f470fdfb3 | |
| parent | 5a2cb3d164568db9394b05db690a35b709661837 (diff) | |
| download | native-fb4585b3dc8e5015dc91469ae004337601172aa9.tar.gz | |
Check for malformed Sensor Flattenable
Test: libsensorserviceaidl_fuzzer with testcase from bug
Bug: 269014004
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:aeec1802f7befc8fbb18313ad3ac0969c3811870)
Merged-In: I0e255c64243c38876fb657cbf942fc1613363216
Change-Id: I0e255c64243c38876fb657cbf942fc1613363216
| -rw-r--r-- | libs/sensor/Sensor.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libs/sensor/Sensor.cpp b/libs/sensor/Sensor.cpp index ec0ced8663..b865c4d5d6 100644 --- a/libs/sensor/Sensor.cpp +++ b/libs/sensor/Sensor.cpp @@ -632,7 +632,13 @@ bool Sensor::unflattenString8(void const*& buffer, size_t& size, String8& output return false; } outputString8.setTo(static_cast<char const*>(buffer), len); + + if (size < FlattenableUtils::align<4>(len)) { + ALOGE("Malformed Sensor String8 field. Should be in a 4-byte aligned buffer but is not."); + return false; + } FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len)); + return true; } |