Disregard alleged binder entities beyond parcel bounds
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 015866b..c1cfb1e 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -451,7 +451,7 @@
// Count objects in range
for (int i = 0; i < (int) size; i++) {
size_t off = objects[i];
- if ((off >= offset) && (off < offset + len)) {
+ if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
if (firstIndex == -1) {
firstIndex = i;
}