commit b82c6f52c0b2464f3d44a5c4cc904ae19648b59d
author Pablo Ceballos <pceballos@google.com> Mon Jul 18 22:32:55 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 18 22:32:55 2016 +0000
tree 030d598cb01dc92c57ee9d7e6ce7dbf59a9809dd
parent 9b39ebe132a18f530a5e5885a9faca514257902a
parent 0ec362e0248aa4cce166140abe80a6b3b45a15d8

Region: Detect malicious overflow in unflatten am: 1a65fccc50 am: fd579a51b5 am: 0e85f4d48d
am: 0ec362e024

Change-Id: Ibf1f0aedeab8552fe2a211d01d8b5c2c1ddafcdd

libs/ui/Region.cpp

diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index ac37990..ee152bf 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@
         return NO_MEMORY;
     }
 
+    if (numRects > (UINT32_MAX / sizeof(Rect))) {
+        android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+        return NO_MEMORY;
+    }
+
     Region result;
     result.mStorage.clear();
     for (size_t r = 0; r < numRects; ++r) {