commit 7a96ec4b2fd73f5261feebb7e8a14cde11726f23
author Marco Nelissen <marcone@google.com> Wed Jun 06 07:37:46 2018 -0700
committer Marco Nelissen <marcone@google.com> Fri Jun 08 08:48:38 2018 -0700
tree 2de6ae1892268f2dc9349d9a99b6eab1f02b41cf
parent 33457e8191fa43b07d1de1bd059c6c9ac9a0966a

Make Parcel::readBlob sanity check the fd

Bug: 78138150
Test: build, boot, run poc
Change-Id: I29db365ffa75e310be195a308a76b3d35e813e96

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index eb8188b..f4885d1 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -2278,6 +2278,15 @@
     int fd = readFileDescriptor();
     if (fd == int(BAD_TYPE)) return BAD_VALUE;
 
+    if (!ashmem_valid(fd)) {
+        ALOGE("invalid fd");
+        return BAD_VALUE;
+    }
+    int size = ashmem_get_size_region(fd);
+    if (size < 0 || size_t(size) < len) {
+        ALOGE("request size %zu does not match fd size %d", len, size);
+        return BAD_VALUE;
+    }
     void* ptr = ::mmap(nullptr, len, isMutable ? PROT_READ | PROT_WRITE : PROT_READ,
             MAP_SHARED, fd, 0);
     if (ptr == MAP_FAILED) return NO_MEMORY;