diff options
author | Arve Hjønnevåg <arve@android.com> | 2014-02-25 00:01:53 +0000 |
---|---|---|
committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2014-02-25 00:01:54 +0000 |
commit | ead79b8365ea33eb0e21a817d5ca563ee1eb56be (patch) | |
tree | 1f41f35c0ac3b49cd73e2691cea82f18c64e79bb | |
parent | d1c87d37025c49f6a47fe43328572da495ff04c1 (diff) | |
parent | 4cab0fd7f788995e3858f992ae760df1cfb7f63d (diff) | |
download | native-ead79b8365ea33eb0e21a817d5ca563ee1eb56be.tar.gz |
Merge "Binder: Make sure binder objects do not overlap"
-rw-r--r-- | libs/binder/Parcel.cpp | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 9f56def83d..159003d169 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -35,6 +35,7 @@ #include <private/binder/binder_module.h> +#include <inttypes.h> #include <stdio.h> #include <stdlib.h> #include <stdint.h> @@ -1342,6 +1343,7 @@ size_t Parcel::ipcObjectsCount() const void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, const binder_size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie) { + binder_size_t minOffset = 0; freeDataNoInit(); mError = NO_ERROR; mData = const_cast<uint8_t*>(data); @@ -1354,6 +1356,16 @@ void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize, mNextObjectHint = 0; mOwner = relFunc; mOwnerCookie = relCookie; + for (size_t i = 0; i < mObjectsSize; i++) { + binder_size_t offset = mObjects[i]; + if (offset < minOffset) { + ALOGE("%s: bad object offset %"PRIu64" < %"PRIu64"\n", + __func__, (uint64_t)offset, (uint64_t)minOffset); + mObjectsSize = 0; + break; + } + minOffset = offset + sizeof(flat_binder_object); + } scanForFds(); } |