summaryrefslogtreecommitdiffstats
path: root/include/media
diff options
context:
space:
mode:
authorAndy Hung <hunga@google.com>2014-07-30 00:59:56 +0000
committerAndroid (Google) Code Review <android-gerrit@google.com>2014-07-29 21:36:00 +0000
commit9f2dcf14cb4bb75bd810f6ed8938e4dbbb18c651 (patch)
tree2fc62a428f44ee115084635471717dbcdd37285e /include/media
parent318be3e7d245aea99efa194a16002395b609ab90 (diff)
parentd00b7d1fb949e226b189e7d0047d78531b3264da (diff)
downloadframeworks_av-9f2dcf14cb4bb75bd810f6ed8938e4dbbb18c651.zip
frameworks_av-9f2dcf14cb4bb75bd810f6ed8938e4dbbb18c651.tar.gz
frameworks_av-9f2dcf14cb4bb75bd810f6ed8938e4dbbb18c651.tar.bz2
Merge "Add isSafeArraySize for new array size checks" into lmp-dev
Diffstat (limited to 'include/media')
-rw-r--r--include/media/stagefright/foundation/ABase.h27
1 files changed, 27 insertions, 0 deletions
diff --git a/include/media/stagefright/foundation/ABase.h b/include/media/stagefright/foundation/ABase.h
index 9eceea3..949d49e 100644
--- a/include/media/stagefright/foundation/ABase.h
+++ b/include/media/stagefright/foundation/ABase.h
@@ -22,4 +22,31 @@
name(const name &); \
name &operator=(const name &)
+/* Returns true if the size parameter is safe for new array allocation (32-bit)
+ *
+ * Example usage:
+ *
+ * if (!isSafeArraySize<uint32_t>(arraySize)) {
+ * return BAD_VALUE;
+ * }
+ * ...
+ * uint32_t *myArray = new uint32_t[arraySize];
+ *
+ * There is a bug in gcc versions earlier than 4.8 where the new[] array allocation
+ * will overflow in the internal 32 bit heap allocation, resulting in an
+ * underallocated array. This is a security issue that allows potential overwriting
+ * of other heap data.
+ *
+ * An alternative to checking is to create a safe new array template function which
+ * either throws a std::bad_alloc exception or returns NULL/nullptr_t; NULL considered
+ * safe since normal access of NULL throws an exception.
+ *
+ * https://securityblog.redhat.com/2012/10/31/array-allocation-in-cxx/
+ */
+template <typename T, typename S>
+bool isSafeArraySize(S size) {
+ return size >= 0 // in case S is signed, ignored if not.
+ && size <= 0xffffffff / sizeof(T); // max-unsigned-32-bit-int / element-size.
+}
+
#endif // A_BASE_H_