| commit | 894ba10a5fa404314649870a1bbf7a41fb7755bd | [log] [tgz] |
|---|---|---|
| author | Casey Dahlin <sadmac@google.com> | Tue Nov 15 23:49:36 2016 +0000 |
| committer | android-build-merger <android-build-merger@google.com> | Tue Nov 15 23:49:36 2016 +0000 |
| tree | 79924c793cd18cfb77e53db8dadf73141aec9c3f | |
| parent | c261a17e516fd2ac5b391c38031759faaef6feb3 [diff] | |
| parent | 65a8f07e57a492289798ca709a311650b5bd5af1 [diff] |
Fix integer overflow in unsafeReadTypedVector am: 65a8f07e57 Change-Id: If37f6f01bfd8e7107063ce6993cf4c2b671fe99b
diff --git a/include/binder/Parcel.h b/include/binder/Parcel.h index 1c355c4..2490b82 100644 --- a/include/binder/Parcel.h +++ b/include/binder/Parcel.h
@@ -589,8 +589,16 @@ return UNEXPECTED_NULL; } + if (val->max_size() < size) { + return NO_MEMORY; + } + val->resize(size); + if (val->size() < size) { + return NO_MEMORY; + } + for (auto& v: *val) { status = (this->*read_func)(&v);