commit 09ba064c131cf6e9fb92bbd02b912867e6b8517d
author Treehugger Robot <treehugger-gerrit@google.com> Fri Jul 08 23:55:11 2022 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Fri Jul 08 23:55:11 2022 +0000
tree 011577813e69708dbf2a53d0bf1760990938e5ee
parent 05f897cae9b8590c43717b3492e470fa0197c330
parent 26b494e2bdfa78d2ecb482df741fb837132d3a43

Merge "libbinder: Fix out-of-bounds abort in RpcServer"

libs/binder/RpcServer.cpp

diff --git a/libs/binder/RpcServer.cpp b/libs/binder/RpcServer.cpp
index ee90710..096d5cc 100644
--- a/libs/binder/RpcServer.cpp
+++ b/libs/binder/RpcServer.cpp
@@ -421,7 +421,9 @@
             session->setMaxIncomingThreads(server->mMaxThreads);
             if (!session->setProtocolVersion(protocolVersion)) return;
 
-            if (server->mSupportedFileDescriptorTransportModes.test(
+            if (header.fileDescriptorTransportMode <
+                        server->mSupportedFileDescriptorTransportModes.size() &&
+                server->mSupportedFileDescriptorTransportModes.test(
                         header.fileDescriptorTransportMode)) {
                 session->setFileDescriptorTransportMode(
                         static_cast<RpcSession::FileDescriptorTransportMode>(