commit 11ed3dccbd7c60f8a3c04f36a5e86b77e2e6b7e8
author Chia-I Wu <olv@google.com> Thu Oct 11 16:40:24 2018 -0700
committer android-build-merger <android-build-merger@google.com> Thu Oct 11 16:40:24 2018 -0700
tree f9246e7b17d6d10e7b92d29a31f583b49bd03bb6
parent b529ce581b0fc58309366c1af9ecbba6c7a72853
parent bf8d7210c4bbbdc875e9695a301cdf9c3b544279

libui: add boundary check to GraphicBuffer::unflatten
am: bf8d7210c4

Change-Id: Ia2ccc52e854e324cebd978ca648de438c23ae660

libs/ui/GraphicBuffer.cpp

diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp
index c880500..6235bd6 100644
--- a/libs/ui/GraphicBuffer.cpp
+++ b/libs/ui/GraphicBuffer.cpp
@@ -372,6 +372,10 @@
 
 status_t GraphicBuffer::unflatten(
         void const*& buffer, size_t& size, int const*& fds, size_t& count) {
+    if (size < 12 * sizeof(int)) {
+        android_errorWriteLog(0x534e4554, "114223584");
+        return NO_MEMORY;
+    }
 
     int const* buf = static_cast<int const*>(buffer);