Use resizeOutVector in IncidentReportArg
IncidentReportArg doesn't handle cases when incorrect vector
length is provided in parcel. Using resizeOutVector Parcel API
instead.
Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
with clusterfuzz testcase
Bug: 283079842
Change-Id: I1682c8920c64faf5b0f2f6cd54b8517ec0f5d877
diff --git a/libs/incident/src/IncidentReportArgs.cpp b/libs/incident/src/IncidentReportArgs.cpp
index db495cf..d344a981 100644
--- a/libs/incident/src/IncidentReportArgs.cpp
+++ b/libs/incident/src/IncidentReportArgs.cpp
@@ -133,13 +133,12 @@
mSections.insert(section);
}
- int32_t headerCount;
- err = in->readInt32(&headerCount);
+ err = in->resizeOutVector<vector<uint8_t>>(&mHeaders);
if (err != NO_ERROR) {
return err;
}
- mHeaders.resize(headerCount);
- for (int i=0; i<headerCount; i++) {
+
+ for (int i=0; i<mHeaders.size(); i++) {
err = in->readByteVector(&mHeaders[i]);
if (err != NO_ERROR) {
return err;