summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2016-04-26 08:44:09 -0700
committerThe Android Automerger <android-build@google.com>2016-05-27 11:31:22 -0700
commit54cb02ad733fb71b1bdf78590428817fb780aff8 (patch)
treee3f22acf46e924f17d0728d816ef4674977c73fd
parent03a53d1c7765eeb3af0bc34c3dff02ada1953fbf (diff)
downloadframeworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.zip
frameworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.tar.gz
frameworks_native-54cb02ad733fb71b1bdf78590428817fb780aff8.tar.bz2
Correctly handle dup() failure in Parcel::readNativeHandle
bail out if dup() fails, instead of creating an invalid native_handle_t Bug: 28395952 Change-Id: Ia1a6198c0f45165b9c6a55a803e5f64d8afa0572
-rw-r--r--libs/binder/Parcel.cpp8
1 files changed, 7 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 22d7ef3..4a660d1 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1377,7 +1377,13 @@ native_handle* Parcel::readNativeHandle() const
for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
h->data[i] = dup(readFileDescriptor());
- if (h->data[i] < 0) err = BAD_VALUE;
+ if (h->data[i] < 0) {
+ for (int j = 0; j < i; j++) {
+ close(h->data[j]);
+ }
+ native_handle_delete(h);
+ return 0;
+ }
}
err = read(h->data + numFds, sizeof(int)*numInts);
if (err != NO_ERROR) {