summaryrefslogtreecommitdiffstats
path: root/libs/binder/Parcel.cpp
diff options
context:
space:
mode:
authorChristopher Tate <ctate@google.com>2015-05-27 17:53:02 -0700
committerChristopher Hocutt <hocutt@google.com>2015-06-24 20:46:05 +0000
commit1b8a2f82fedffbc0b24c884def197db392b16576 (patch)
treec3568efa357aafa4a05e01e3a65fc164d1133569 /libs/binder/Parcel.cpp
parent861c3f56157813627467054f488ecff7d339f2b0 (diff)
downloadframeworks_native-1b8a2f82fedffbc0b24c884def197db392b16576.zip
frameworks_native-1b8a2f82fedffbc0b24c884def197db392b16576.tar.gz
frameworks_native-1b8a2f82fedffbc0b24c884def197db392b16576.tar.bz2
Disregard alleged binder entities beyond parcel bounds
When appending one parcel's contents to another, ignore binder objects within the source Parcel that appear to lie beyond the formal bounds of that Parcel's data buffer. Bug 17312693 Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514 (cherry picked from commit 27182be9f20f4f5b48316666429f09b9ecc1f22e)
Diffstat (limited to 'libs/binder/Parcel.cpp')
-rw-r--r--libs/binder/Parcel.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 777bc3c..a24621b 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -390,7 +390,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
// Count objects in range
for (int i = 0; i < (int) size; i++) {
size_t off = objects[i];
- if ((off >= offset) && (off < offset + len)) {
+ if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
if (firstIndex == -1) {
firstIndex = i;
}