commit 0e85f4d48da5a7d5bf9ce6fe2c0463b38efac512
author Pablo Ceballos <pceballos@google.com> Mon Jul 18 22:28:15 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 18 22:28:15 2016 +0000
tree e83d7017c297f9f88d1886ed2672ad0678a3d894
parent ed968dc61c3d681052b809054c202557a1d9164e
parent fd579a51b5787bef19a6f5c2b27fce44db0b05d9

Region: Detect malicious overflow in unflatten am: 1a65fccc50
am: fd579a51b5

Change-Id: I2d584199f001f7da8f4331729d796cf527ba79fd

libs/ui/Region.cpp

diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 3810da4..cfed7a9 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@
         return NO_MEMORY;
     }
 
+    if (numRects > (UINT32_MAX / sizeof(Rect))) {
+        android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+        return NO_MEMORY;
+    }
+
     Region result;
     result.mStorage.clear();
     for (size_t r = 0; r < numRects; ++r) {