commit 70b9a03dc32789d371eccf47ccef00e044649e3a
author Casey Dahlin <sadmac@google.com> Wed Nov 16 00:11:07 2016 +0000
committer android-build-merger <android-build-merger@google.com> Wed Nov 16 00:11:07 2016 +0000
tree 2e972baf085a840011d627f165c2f6992881633c
parent f69a37981fd7b8f9ee4eda517931d47bf107c7cb
parent 5fef0c6d88a66ab51bcf2219fa481e20bfb842f3

Fix integer overflow in unsafeReadTypedVector am: 65a8f07e57 am: 894ba10a5f am: b7a1cc50d2
am: 5fef0c6d88

Change-Id: I1b75c83f3b2daaad30c42b0a3fed0add0cead5ee

include/binder/Parcel.h

diff --git a/include/binder/Parcel.h b/include/binder/Parcel.h
index 1c355c4..2490b82 100644
--- a/include/binder/Parcel.h
+++ b/include/binder/Parcel.h
@@ -589,8 +589,16 @@
         return UNEXPECTED_NULL;
     }
 
+    if (val->max_size() < size) {
+        return NO_MEMORY;
+    }
+
     val->resize(size);
 
+    if (val->size() < size) {
+        return NO_MEMORY;
+    }
+
     for (auto& v: *val) {
         status = (this->*read_func)(&v);