commit fd579a51b5787bef19a6f5c2b27fce44db0b05d9
author Pablo Ceballos <pceballos@google.com> Mon Jul 18 22:25:45 2016 +0000
committer android-build-merger <android-build-merger@google.com> Mon Jul 18 22:25:45 2016 +0000
tree 90d28794e584c9238b7f494b8dddbb4b963ba10a
parent 81d678cf189d8b1df1022ab7dfbf94c25db05b8c
parent 1a65fccc500c9d75adabbc06cd7d26ec01c3f333

Region: Detect malicious overflow in unflatten
am: 1a65fccc50

Change-Id: I597a130dfe82c21c5611f45f6977b189c0a1a8ea

libs/ui/Region.cpp

diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 3810da4..cfed7a9 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@
         return NO_MEMORY;
     }
 
+    if (numRects > (UINT32_MAX / sizeof(Rect))) {
+        android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+        return NO_MEMORY;
+    }
+
     Region result;
     result.mStorage.clear();
     for (size_t r = 0; r < numRects; ++r) {