commit dc3d6af97d521678981c773ad9f4e1da088d7870
author Christopher Tate <ctate@google.com> Thu Jul 02 01:31:09 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Jul 02 01:31:09 2015 +0000
tree 917e44341b76e4a712ecaa379262a0e84561024d
parent 9004e7f5516c5b4a1b4178fa6a8bb4b3ca4ddcd0
parent bb686c25b214edadd1830abd056db2d570d716ff

am bb686c25: Disregard alleged binder entities beyond parcel bounds

* commit 'bb686c25b214edadd1830abd056db2d570d716ff':
  Disregard alleged binder entities beyond parcel bounds

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index e5a2871..0464e93 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -384,7 +384,7 @@
     // Count objects in range
     for (int i = 0; i < (int) size; i++) {
         size_t off = objects[i];
-        if ((off >= offset) && (off < offset + len)) {
+        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
             if (firstIndex == -1) {
                 firstIndex = i;
             }