Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug: 29833520
Test: atest android.os.cts.ParcelTest
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index cb542bf..2e7edd7 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1535,7 +1535,12 @@
&& len <= pad_size(len)) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len));
- if(err != NO_ERROR) return err;
+ if(err != NO_ERROR) {
+ // Still increment the data position by the expected length
+ mDataPos += pad_size(len);
+ ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
+ return err;
+ }
}
memcpy(outData, mData+mDataPos, len);
mDataPos += pad_size(len);
@@ -1557,7 +1562,12 @@
&& len <= pad_size(len)) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len));
- if(err != NO_ERROR) return NULL;
+ if(err != NO_ERROR) {
+ // Still increment the data position by the expected length
+ mDataPos += pad_size(len);
+ ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
+ return NULL;
+ }
}
const void* data = mData+mDataPos;
@@ -1575,7 +1585,11 @@
if ((mDataPos+sizeof(T)) <= mDataSize) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + sizeof(T));
- if(err != NO_ERROR) return err;
+ if(err != NO_ERROR) {
+ // Still increment the data position by the expected length
+ mDataPos += sizeof(T);
+ return err;
+ }
}
const void* data = mData+mDataPos;