commit 17e214f052d2e30f9ef2ec38d0ab96485a4bd22e
author Treehugger Robot <treehugger-gerrit@google.com> Sat Jul 09 01:19:37 2022 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Sat Jul 09 01:19:37 2022 +0000
tree 0d7f9ac3ac8119b979abf7fd9c45159d25e7d1c2
parent 69670d951e7324c0fb08bb75f4f841c0c3cca597
parent 1f9c04300ac0aa16037f4a56e44fb07b16415bfa

Merge "libbinder: Fix out-of-bounds abort in RpcServer" am: 09ba064c13 am: e43e5bea0f am: 80495c92a8 am: 1f9c04300a

Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2146845

Change-Id: I9e256f8ac9249e29c00c4da53b2038fcfa118c27
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

libs/binder/RpcServer.cpp

diff --git a/libs/binder/RpcServer.cpp b/libs/binder/RpcServer.cpp
index ee90710..096d5cc 100644
--- a/libs/binder/RpcServer.cpp
+++ b/libs/binder/RpcServer.cpp
@@ -421,7 +421,9 @@
             session->setMaxIncomingThreads(server->mMaxThreads);
             if (!session->setProtocolVersion(protocolVersion)) return;
 
-            if (server->mSupportedFileDescriptorTransportModes.test(
+            if (header.fileDescriptorTransportMode <
+                        server->mSupportedFileDescriptorTransportModes.size() &&
+                server->mSupportedFileDescriptorTransportModes.test(
                         header.fileDescriptorTransportMode)) {
                 session->setFileDescriptorTransportMode(
                         static_cast<RpcSession::FileDescriptorTransportMode>(