diff options
| author | Chia-I Wu <olv@google.com> | 2018-10-11 16:40:24 -0700 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2018-10-11 16:40:24 -0700 |
| commit | 11ed3dccbd7c60f8a3c04f36a5e86b77e2e6b7e8 (patch) | |
| tree | f9246e7b17d6d10e7b92d29a31f583b49bd03bb6 | |
| parent | b529ce581b0fc58309366c1af9ecbba6c7a72853 (diff) | |
| parent | bf8d7210c4bbbdc875e9695a301cdf9c3b544279 (diff) | |
| download | native-11ed3dccbd7c60f8a3c04f36a5e86b77e2e6b7e8.tar.gz | |
libui: add boundary check to GraphicBuffer::unflatten
am: bf8d7210c4
Change-Id: Ia2ccc52e854e324cebd978ca648de438c23ae660
| -rw-r--r-- | libs/ui/GraphicBuffer.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp index c8805000a4..6235bd6cc4 100644 --- a/libs/ui/GraphicBuffer.cpp +++ b/libs/ui/GraphicBuffer.cpp @@ -372,6 +372,10 @@ status_t GraphicBuffer::flatten(void*& buffer, size_t& size, int*& fds, size_t& status_t GraphicBuffer::unflatten( void const*& buffer, size_t& size, int const*& fds, size_t& count) { + if (size < 12 * sizeof(int)) { + android_errorWriteLog(0x534e4554, "114223584"); + return NO_MEMORY; + } int const* buf = static_cast<int const*>(buffer); |