| commit | e81a4f15185486cd67ff8983f9826d42ef653088 | [log] [tgz] |
|---|---|---|
| author | Casey Dahlin <sadmac@google.com> | Tue Nov 15 23:40:20 2016 +0000 |
| committer | Android (Google) Code Review <android-gerrit@google.com> | Tue Nov 15 23:40:20 2016 +0000 |
| tree | e1563c9d8ac3b9035ccbf6534f2f4b523859c127 | |
| parent | b17adaa85f8bd7112c0efb872ce461aaf70f73ef [diff] | |
| parent | 65a8f07e57a492289798ca709a311650b5bd5af1 [diff] |
Merge "Fix integer overflow in unsafeReadTypedVector" into nyc-dev
diff --git a/include/binder/Parcel.h b/include/binder/Parcel.h index 1c355c4..2490b82 100644 --- a/include/binder/Parcel.h +++ b/include/binder/Parcel.h
@@ -589,8 +589,16 @@ return UNEXPECTED_NULL; } + if (val->max_size() < size) { + return NO_MEMORY; + } + val->resize(size); + if (val->size() < size) { + return NO_MEMORY; + } + for (auto& v: *val) { status = (this->*read_func)(&v);