commit fb6342d2bbf0f5e324ea1685a0b3cfc4af648ee7
author Marco Nelissen <marcone@google.com> Mon May 09 21:38:19 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon May 09 21:38:19 2016 +0000
tree bd43d2e90b6aa6563864f0f5e4cac8fe6f1a5875
parent f96fff5015f6823c9fde7fa603bb58ee05c5c242
parent f91c66a9a889f0ed851953dd0c1b2ff70e622dda

Correctly handle dup() failure in Parcel::readNativeHandle am: 1de7966c72 am: 275c9f60f9 am: 853702ce3d am: 775f2e6dbf am: 82afbe2258 am: c2c470c700 am: 56dea28189 am: bca20d8376 am: a8244873a8 am: 93bf31f54d
am: f91c66a9a8

* commit 'f91c66a9a889f0ed851953dd0c1b2ff70e622dda':
  Correctly handle dup() failure in Parcel::readNativeHandle

Change-Id: Ib4a4fe7d4ca8291fb82fcbbd91c3a0803a1e1b30

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index a0161b3..c7e8ff2 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1964,7 +1964,13 @@
 
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
-        if (h->data[i] < 0) err = BAD_VALUE;
+        if (h->data[i] < 0) {
+            for (int j = 0; j < i; j++) {
+                close(h->data[j]);
+            }
+            native_handle_delete(h);
+            return 0;
+        }
     }
     err = read(h->data + numFds, sizeof(int)*numInts);
     if (err != NO_ERROR) {