From eb5d7f2f1cc049ea7f95a4f089ce2113d7683dda Mon Sep 17 00:00:00 2001 From: Lajos Molnar Date: Mon, 24 Mar 2014 16:18:36 -0700 Subject: mtp: avoid silent allocation overflow in MtpProperty Bug: 13006907 Change-Id: Ice0352394840132c9c2ce6c28366632c792a32c0 --- media/mtp/MtpProperty.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'media/mtp') diff --git a/media/mtp/MtpProperty.cpp b/media/mtp/MtpProperty.cpp index 3838ce8..c500901 100644 --- a/media/mtp/MtpProperty.cpp +++ b/media/mtp/MtpProperty.cpp @@ -17,6 +17,7 @@ #define LOG_TAG "MtpProperty" #include +#include #include "MtpDataPacket.h" #include "MtpDebug.h" #include "MtpProperty.h" @@ -518,8 +519,14 @@ void MtpProperty::writeValue(MtpDataPacket& packet, MtpPropertyValue& value) { MtpPropertyValue* MtpProperty::readArrayValues(MtpDataPacket& packet, int& length) { length = packet.getUInt32(); - if (length == 0) + // Fail if resulting array is over 2GB. This is because the maximum array + // size may be less than SIZE_MAX on some platforms. + if ( CC_UNLIKELY( + length == 0 || + length >= INT32_MAX / sizeof(MtpPropertyValue)) ) { + length = 0; return NULL; + } MtpPropertyValue* result = new MtpPropertyValue[length]; for (int i = 0; i < length; i++) readValue(packet, result[i]); -- cgit v1.1