diff options
| author | Christopher Tate <ctate@google.com> | 2015-07-02 01:55:43 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-07-02 01:55:43 +0000 |
| commit | 134fd91bccde911bf9497f09841ec9922bbefec9 (patch) | |
| tree | 2a5380c2686553e2b987bee8cf76b256455209fb /libs/binder | |
| parent | 209ea40e8f3ccda405cd4e99c768b9b9b43e9dfa (diff) | |
| parent | 708b42e0ee5ad97b8426a6245f73131ddfc59a33 (diff) | |
| download | frameworks_native-134fd91bccde911bf9497f09841ec9922bbefec9.zip frameworks_native-134fd91bccde911bf9497f09841ec9922bbefec9.tar.gz frameworks_native-134fd91bccde911bf9497f09841ec9922bbefec9.tar.bz2 | |
am 708b42e0: am eba7afcc: am 2f340be3: Disregard alleged binder entities beyond parcel bounds
* commit '708b42e0ee5ad97b8426a6245f73131ddfc59a33':
Disregard alleged binder entities beyond parcel bounds
Diffstat (limited to 'libs/binder')
| -rw-r--r-- | libs/binder/Parcel.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index b2a4aae..d769caa 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -411,7 +411,7 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len) // Count objects in range for (int i = 0; i < (int) size; i++) { size_t off = objects[i]; - if ((off >= offset) && (off < offset + len)) { + if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) { if (firstIndex == -1) { firstIndex = i; } |