commit fa2d892ce21a54be49a712cc27f594e7339c4c83
author Chia-I Wu <olv@google.com> Thu Oct 11 16:53:23 2018 -0700
committer android-build-merger <android-build-merger@google.com> Thu Oct 11 16:53:23 2018 -0700
tree 213c06009b2711a0fbdaf205382079cd067887a8
parent dc72b537c58022c24d8bcad760d5f279a9546970
parent e23933651a4ff6995d01b2b29cadfa4733106573

libui: add boundary check to GraphicBuffer::unflatten am: bf8d7210c4 am: 11ed3dccbd
am: e23933651a

Change-Id: Iaa1d0e377549d6b35346d8d20ba6b9131ccf3a8f

libs/ui/GraphicBuffer.cpp

diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp
index 0382479..c50d1d0 100644
--- a/libs/ui/GraphicBuffer.cpp
+++ b/libs/ui/GraphicBuffer.cpp
@@ -376,6 +376,10 @@
 
 status_t GraphicBuffer::unflatten(
         void const*& buffer, size_t& size, int const*& fds, size_t& count) {
+    if (size < 12 * sizeof(int)) {
+        android_errorWriteLog(0x534e4554, "114223584");
+        return NO_MEMORY;
+    }
 
     int const* buf = static_cast<int const*>(buffer);