Fix fd leak in Binder
Bug: 29982873
Test: Ran poc executable provided with bug report. After this
patch, the device is able to use the Camera after the DoS attemp.
Change-Id: I5990a25c76e9d78616caec4fc98fb5547f37a0de
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 601df46..470fc59 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -2094,11 +2094,15 @@
status_t err = NO_ERROR;
for (size_t i=0 ; i<fd_count && err==NO_ERROR ; i++) {
- fds[i] = dup(this->readFileDescriptor());
- if (fds[i] < 0) {
+ int fd = this->readFileDescriptor();
+ if (fd < 0 || ((fds[i] = dup(fd)) < 0)) {
err = BAD_VALUE;
ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
- i, fds[i], fd_count, strerror(errno));
+ i, fds[i], fd_count, strerror(fd < 0 ? -fd : errno));
+ // Close all the file descriptors that were dup-ed.
+ for (size_t j=0; j<i ;j++) {
+ close(fds[j]);
+ }
}
}