commit 9ef37cdcdc17f19c94fb184048a01b1031b61fe8
author Christopher Tate <ctate@google.com> Tue Dec 06 00:28:19 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Dec 06 00:28:19 2016 +0000
tree ced337a40a0ef22ed826e5f6e22af0ef16783620
parent 1f24f0f597ef318efb7db579563e4c06c60242df
parent 9d5dd3f584d7585ee6814a5606f14a4b9d68b8f8

resolve merge conflicts of 13c5c34 to mnc-dev am: 79b74d787d am: abe293b950 am: 02e4440eab am: 953c05276e am: e37a4dc7c4 am: 8ed5e3d7ca
am: 9d5dd3f584

Change-Id: Ic7effb22aa05c626d007aef30ab572363197cad3

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index e88ae29..19ce3eb 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -548,7 +548,7 @@
         // grow objects
         if (mObjectsCapacity < mObjectsSize + numObjects) {
             size_t newSize = ((mObjectsSize + numObjects)*3)/2;
-            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
             binder_size_t *objects =
                 (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
             if (objects == (binder_size_t*)0) {
@@ -1342,7 +1342,7 @@
     }
     if (!enoughObjects) {
         size_t newSize = ((mObjectsSize+2)*3)/2;
-        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
         binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
         if (objects == NULL) return NO_MEMORY;
         mObjects = objects;