diff options
| author | Marco Nelissen <marcone@google.com> | 2016-04-26 08:44:09 -0700 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-05-27 11:31:22 -0700 |
| commit | 54cb02ad733fb71b1bdf78590428817fb780aff8 (patch) | |
| tree | e3f22acf46e924f17d0728d816ef4674977c73fd | |
| parent | 03a53d1c7765eeb3af0bc34c3dff02ada1953fbf (diff) | |
| download | frameworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.zip frameworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.tar.gz frameworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.tar.bz2 | |
Correctly handle dup() failure in Parcel::readNativeHandle
bail out if dup() fails, instead of creating an invalid native_handle_t
Bug: 28395952
Change-Id: Ia1a6198c0f45165b9c6a55a803e5f64d8afa0572
| -rw-r--r-- | libs/binder/Parcel.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 22d7ef3..4a660d1 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -1377,7 +1377,13 @@ native_handle* Parcel::readNativeHandle() const for (int i=0 ; err==NO_ERROR && i<numFds ; i++) { h->data[i] = dup(readFileDescriptor()); - if (h->data[i] < 0) err = BAD_VALUE; + if (h->data[i] < 0) { + for (int j = 0; j < i; j++) { + close(h->data[j]); + } + native_handle_delete(h); + return 0; + } } err = read(h->data + numFds, sizeof(int)*numInts); if (err != NO_ERROR) { |