diff options
| author | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2016-12-13 02:15:45 +0100 |
|---|---|---|
| committer | Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de> | 2016-12-13 02:15:45 +0100 |
| commit | d3ad4f1e64dfe162c03fbbbe79c21c3c20641f18 (patch) | |
| tree | a21f7d76365795800eebfd006d34803a9304e04c /libs/ui | |
| parent | b2381c3e4b90d845d9713b7b29d64317b7f21ce8 (diff) | |
| parent | b22bca465e55618a949d9cbdea665a1a3a831241 (diff) | |
| download | frameworks_native-d3ad4f1e64dfe162c03fbbbe79c21c3c20641f18.zip frameworks_native-d3ad4f1e64dfe162c03fbbbe79c21c3c20641f18.tar.gz frameworks_native-d3ad4f1e64dfe162c03fbbbe79c21c3c20641f18.tar.bz2 | |
Merge branch 'cm-13.0' of https://github.com/CyanogenMod/android_frameworks_native into replicant-6.0
Diffstat (limited to 'libs/ui')
| -rw-r--r-- | libs/ui/Region.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp index 3810da4..cfed7a9 100644 --- a/libs/ui/Region.cpp +++ b/libs/ui/Region.cpp @@ -795,6 +795,11 @@ status_t Region::unflatten(void const* buffer, size_t size) { return NO_MEMORY; } + if (numRects > (UINT32_MAX / sizeof(Rect))) { + android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0); + return NO_MEMORY; + } + Region result; result.mStorage.clear(); for (size_t r = 0; r < numRects; ++r) { |