diff options
| author | Marco Nelissen <marcone@google.com> | 2016-04-26 08:44:09 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-05-27 10:29:21 -0700 |
| commit | 443040b58d15ca559cf99be216a2f087205d838d (patch) | |
| tree | e3f22acf46e924f17d0728d816ef4674977c73fd | |
| parent | 489ba53e282b97dd4acd823885904a6f8f3fa494 (diff) | |
| download | native-443040b58d15ca559cf99be216a2f087205d838d.tar.gz | |
Correctly handle dup() failure in Parcel::readNativeHandleandroid-6.0.1_r48android-6.0.1_r47
bail out if dup() fails, instead of creating an invalid native_handle_t
Bug: 28395952
Change-Id: Ia1a6198c0f45165b9c6a55a803e5f64d8afa0572
| -rw-r--r-- | libs/binder/Parcel.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 22d7ef36c3..4a660d1fbe 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -1377,7 +1377,13 @@ native_handle* Parcel::readNativeHandle() const for (int i=0 ; err==NO_ERROR && i<numFds ; i++) { h->data[i] = dup(readFileDescriptor()); - if (h->data[i] < 0) err = BAD_VALUE; + if (h->data[i] < 0) { + for (int j = 0; j < i; j++) { + close(h->data[j]); + } + native_handle_delete(h); + return 0; + } } err = read(h->data + numFds, sizeof(int)*numInts); if (err != NO_ERROR) { |