diff options
author | Adam Lesinski <adamlesinski@google.com> | 2015-04-27 12:13:33 -0700 |
---|---|---|
committer | The Android Automerger <android-build@android.com> | 2015-08-13 19:53:03 -0700 |
commit | e8c62fb484151f76ab88b1d5130f38de24ac8c14 (patch) | |
tree | d9f0dd6e806932662c1a158f10a1363ec569ea60 | |
parent | 5b3aa21bc70d42b3fcb1764a1be04ab8db5ebfb9 (diff) | |
download | core-e8c62fb484151f76ab88b1d5130f38de24ac8c14.tar.gz |
Prevent integer overflow when allocating native_handle_tandroid-5.1.1_r16android-5.1.1_r15android-5.1.1_r14
User specified values of numInts and numFds can overflow
and cause malloc to allocate less than we expect, causing
heap corruption in subsequent operations on the allocation.
Bug: 19334482
Change-Id: I43c75f536ea4c08f14ca12ca6288660fd2d1ec55
-rw-r--r-- | libcutils/native_handle.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libcutils/native_handle.c b/libcutils/native_handle.c index 9a4a5bb38..61fa38ed4 100644 --- a/libcutils/native_handle.c +++ b/libcutils/native_handle.c @@ -25,11 +25,17 @@ #include <cutils/log.h> #include <cutils/native_handle.h> +static const int kMaxNativeFds = 1024; +static const int kMaxNativeInts = 1024; + native_handle_t* native_handle_create(int numFds, int numInts) { - native_handle_t* h = malloc( - sizeof(native_handle_t) + sizeof(int)*(numFds+numInts)); + if (numFds < 0 || numInts < 0 || numFds > kMaxNativeFds || numInts > kMaxNativeInts) { + return NULL; + } + size_t mallocSize = sizeof(native_handle_t) + (sizeof(int) * (numFds + numInts)); + native_handle_t* h = malloc(mallocSize); if (h) { h->version = sizeof(native_handle_t); h->numFds = numFds; |