commit 732132b765cd7b667f16cf32f0fe4c852d7d44dd
author Martijn Coenen <maco@google.com> Wed Apr 04 11:46:56 2018 +0200
committer Atanas Kirilov <akirilov@google.com> Mon Apr 16 18:57:32 2018 +0000
tree d451e739649e0309ac14aa64792259b896fbeed1
parent 27f3e039d8f7ba06090eccfc00b2420021ba2acc

Don't pad before calling writeInPlace().

writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.

Bug: 77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44

(cherry picked from commit f8542381b72a7bb2452a5278a00ca8c34edbf8a0)

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index cfcf73b..4d6ea88 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -985,7 +985,7 @@
     if (err) return err;
 
     // payload
-    void* const buf = this->writeInplace(pad_size(len));
+    void* const buf = this->writeInplace(len);
     if (buf == NULL)
         return BAD_VALUE;