Check for null data buffer in AParcel_marshal
Test: m binder_parcel_fuzzer &&
out/host/linux-x86/fuzz/x86_64/binder_parcel_fuzzer/binder_parcel_fuzzer
Bug: 265412053
Change-Id: I2f2b9b82ef1f86ba046deffba6d719c1be433ab5
diff --git a/libs/binder/ndk/parcel.cpp b/libs/binder/ndk/parcel.cpp
index 8693022..94f72d9 100644
--- a/libs/binder/ndk/parcel.cpp
+++ b/libs/binder/ndk/parcel.cpp
@@ -700,6 +700,9 @@
return STATUS_BAD_VALUE;
}
const uint8_t* internalBuffer = parcel->get()->data();
+ if (internalBuffer == nullptr) {
+ return STATUS_UNEXPECTED_NULL;
+ }
memcpy(buffer, internalBuffer + start, len);
return STATUS_OK;
}