commit 26b494e2bdfa78d2ecb482df741fb837132d3a43
author Frederick Mayle <fmayle@google.com> Fri Jul 08 22:09:58 2022 +0000
committer Frederick Mayle <fmayle@google.com> Fri Jul 08 22:11:14 2022 +0000
tree c3e6cc213127678298237fc99bad73fa1b75474a
parent 37ebee73710cbed9e38a44886f780153f76fe722

libbinder: Fix out-of-bounds abort in RpcServer

Bug: 237639446
Test: atest binderRpcTest
Change-Id: Ic35a75fe2b218ef024c6e5e33901813a454243d6

libs/binder/RpcServer.cpp

diff --git a/libs/binder/RpcServer.cpp b/libs/binder/RpcServer.cpp
index 1cd1fd3..f2a620d 100644
--- a/libs/binder/RpcServer.cpp
+++ b/libs/binder/RpcServer.cpp
@@ -420,7 +420,9 @@
             session->setMaxIncomingThreads(server->mMaxThreads);
             if (!session->setProtocolVersion(protocolVersion)) return;
 
-            if (server->mSupportedFileDescriptorTransportModes.test(
+            if (header.fileDescriptorTransportMode <
+                        server->mSupportedFileDescriptorTransportModes.size() &&
+                server->mSupportedFileDescriptorTransportModes.test(
                         header.fileDescriptorTransportMode)) {
                 session->setFileDescriptorTransportMode(
                         static_cast<RpcSession::FileDescriptorTransportMode>(