libbinder: Parcel: validate read data before write
This is slow, but it's required to prevent memory
corruption.
Ignore-AOSP-First: security
Bug: 370840874
Test: fuzzer
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c54dad65317f851ce9d016bd90ec6a7a04da09fc)
Merged-In: Ibc5566ade0389221690dc90324f93394cf7fc9a5
Change-Id: Ibc5566ade0389221690dc90324f93394cf7fc9a5
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index b3e3f6e..0330973 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1211,6 +1211,10 @@
//printf("Writing %ld bytes, padded to %ld\n", len, padded);
uint8_t* const data = mData+mDataPos;
+ if (status_t status = validateReadData(mDataPos + padded); status != OK) {
+ return nullptr; // drops status
+ }
+
// Need to pad at end?
if (padded != len) {
#if BYTE_ORDER == BIG_ENDIAN
@@ -1799,6 +1803,10 @@
const bool enoughObjects = kernelFields->mObjectsSize < kernelFields->mObjectsCapacity;
if (enoughData && enoughObjects) {
restart_write:
+ if (status_t status = validateReadData(mDataPos + sizeof(val)); status != OK) {
+ return status;
+ }
+
*reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
// remember if it's a file descriptor
@@ -2042,6 +2050,10 @@
if ((mDataPos+sizeof(val)) <= mDataCapacity) {
restart_write:
+ if (status_t status = validateReadData(mDataPos + sizeof(val)); status != OK) {
+ return status;
+ }
+
memcpy(mData + mDataPos, &val, sizeof(val));
return finishWrite(sizeof(val));
}