| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
| |
writeByteArray writes the size using sizeof(size_t), however it is always
read using readInt32(). On devices where sizeof(size_t) != 4 this causes
extra bytes to be written.
BUG: 22204736
Change-Id: I8d4507b6b616857ef5827f1fe9da0907d09abf0e
|
|
|
|
|
|
|
|
|
|
|
| |
Make sure that we don't go haywire if an exponential buffer growth
operation winds up wrapping integer range. Along the way, fix a
bookkeeping bug in BufferedTextOutput that would cause it to keep
spuriously realloc()ing on every append().
Bug 20674694
Change-Id: Ia845b7de36b90672a151a918ffc26c7da68e20a2
|
|
|
|
|
|
|
|
|
|
|
| |
We now check for fd-legality before committing binder objects to
the flattened data buffer rather than after. Previously we would
wind up corrupting the parcel and incurring driver-level errors,
as well as potentially leaking FDs.
Bug 21428802
Change-Id: Ice0d641b3dcc41fb1b8c68ce2e2ebd744c2863a1
|
|
|
|
|
|
|
|
|
|
|
| |
Add functions to allow a client to take over the ashmem region
that was transferred so that it can claim it for its own and
reuse it.
Add support for mutable ashmem regions too.
Bug: 21428802
Change-Id: I16eca338cdb99b07d81fc43573d53ce86dbc60c8
|
|
|
|
|
|
|
|
| |
Attempts to replicate Java parceling in native code is fraught with
peril.
Change-Id: I4359036c5dddd1b886d886beef1d060523e53e5f
(cherry picked from commit f47a381001d4d4ce66c2e35aac5b96a26acc0730)
|
|
|
|
|
|
|
|
|
|
| |
When appending one parcel's contents to another, ignore binder
objects within the source Parcel that appear to lie beyond the
formal bounds of that Parcel's data buffer.
Bug 17312693
Change-Id: If592a260f3fcd9a56fc160e7feb2c8b44c73f514
|
|
|
|
|
|
|
|
|
| |
The inputs to native_handle_create can cause an overflowed allocation,
so check the return value of native_handle_create before accessing
the memory it returns.
Bug:19334482
Change-Id: I1f489382776c2a1390793a79dc27ea17baa9b2a2
|
|
|
|
|
|
|
| |
(cherrypicked from commit 6329f0199ed04030e6c2bd7aecd036387b732c71)
Bug: 20669363
Change-Id: Ia4c8d8ca9d8b4b87954d7267e8b1c94cf4e570e1
|
|
|
|
|
|
|
| |
Requires change Ifaf115da in frameworks/base.
Bug: 20079551
Change-Id: Ifaf115dabd1a59cdb1b46e2d49c41f64ac107de4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It's a security best practice for size_t values to be rejected if
they are greater than INT32_SIZE. This is intended to prevent the
common error of inadvertently passing a negative int value to a
function, which after conversion to an unsigned type, becomes a huge
number, defeating the purpose of bounds checking.
This patch also addresses a bug where the call to:
Parcel::write(buf, (size_t) -1);
would call writeInPlace() which uses PAD_SIZE on the supplied
argument. This would then cause an integer overflow, with PAD_SIZE
returning a small value, but the memcpy in Parcel::write using the
old large length value.
Bug: 19573085
Change-Id: Ib11bfb3dae4f3be91cd17b2c676926700972c7b8
|
|
|
|
|
| |
Bug: 19620911
Change-Id: Ifce5319e4e35afd344dead67ab7ba1cd399476a3
|
|\
| |
| |
| |
| | |
* commit '8f3ade0c9ab52a1e4f13d6ff1922dd98e3ccdbcc':
Follow StrictMode refactoring.
|
| |
| |
| |
| |
| | |
Bug: 18335678
Change-Id: Iea920cfa26b5ebfd77b4601c9e6e65b21599342a
|
|\ \
| |/
| |
| |
| | |
* commit '80e8150549c9d8380dadf942336d41ab3d92bf78':
binder: Add {read,write}Uint32 methods to Parcel
|
| |
| |
| |
| |
| |
| |
| |
| | |
Adds readUint32 and writeUint32 methods to the Parcel class. This
saves a lot of static_casting in anything implementing a Binder
interface on the native side.
Change-Id: Iafc73b0633654a3a4c49767f41806b56906c924f
|
|\ \
| |/
| |
| |
| | |
* commit 'c894c2045f589571c80af0648e7a9dcd7e97b6a8':
C++11 compatibility.
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Explicit conversion for atomic_uintptr_t initialization.
* Fix string literal concatenation to not be a UD literal.
* Use __typeof__ instead of typeof (should become decltype once this
actually moves to C++11).
Bug: 18466763
Change-Id: I4eedddfb945a2a703ed27317cb6e2b3041b1ebfc
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
...in Parcel destructor
Don't use a Mutux object, just use simple posix mutex primitives,
to avoid static init/destroy order problems.
Change-Id: Ic012d94297564c0a55d58869f8276d7d10545fbc
|
| |
| |
| |
| | |
Change-Id: I76ffed0e69ccfe70e87d98646f11d4de7c3fd980
|
| |
| |
| |
| |
| |
| |
| |
| | |
Underlying bug has been fixed, extra debug code no longer needed
This reverts commit 36273c991b189c5516819f4d5e3f83061c320593.
Change-Id: Ia47f1ae9ee7338329bfb8d710aff57e15e944f20
|
|/
|
|
|
|
|
|
| |
Underlying bug has been fixed, extra debug code no longer needed.
This reverts commit ccf851f108c008d086b7f3c3923d60d385985e71.
Change-Id: I19ad9239efdf1d8f70cd74af9b7c2ae97713208f
|
|
|
|
|
|
|
|
|
|
|
| |
mmap returns MAP_FAILED (which is -1) and not NULL on
failure.
Diagnosed by cferris.
bug: 17909809
Change-Id: I609788ebf94742ef88af002d2d3f3bc9b9e520ac
|
|
|
|
|
|
|
|
|
| |
Temporary extra debug validation for b/17477219: a Parcel recipient is
getting a positive but invalid fd unexpectedly. Trying to track down
where it's coming from.
Debug code for bug: 17477219
Change-Id: Idb1e71621025a3928c7adc88fd44790e1abd2a01
|
|
|
|
| |
Bug: 17477219
Change-Id: Ide0ae16d777c9af783023c705c18a93c00999147
|
|
|
|
|
|
|
|
| |
All uses of this API have been removed. It should
never have been made public in the first place.
bug: 15424960
Change-Id: Id07d24ec95b2b393e6da138a7e8a9a4ecebeca94
|
|\ |
|
| |
| |
| |
| |
| |
| | |
Mips specific code was using an uninitialized variable.
Change-Id: I445043c76ebfa420b26376ade60f8068b4ea0b11
|
|\ \
| |/
|/|
| |
| | |
* commit 'f0a2475905786d5457e7af838ac714acbfdafa4f':
binder: Turn on -Werror
|
| |\
| | |
| | |
| | |
| | | |
* commit 'a28750eec38c848230adfeef28725b29cc36a9da':
binder: Turn on -Werror
|
| | |
| | |
| | |
| | | |
Change-Id: I0ee785927a7ae5f731b02176b0b781b87c22a24e
|
|\ \ \
| |/ /
| | |
| | |
| | |
| | |
| | | |
when exceptions occur during binder transactions."
* commit '57fdbbda2c475d2abdd828177f942ddb6d164bef':
Add error message for hints when exceptions occur during binder transactions.
|
| |\ \
| | |/
| | |
| | |
| | |
| | |
| | | |
occur during binder transactions."
* commit '4314ccd1ba9fe773b0fc91f0a08dc536ebce8dfe':
Add error message for hints when exceptions occur during binder transactions.
|
| | |\
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
binder transactions."
* commit '70278fbfe012c1fce3e63a41ffb9feaf1e53a64a':
Add error message for hints when exceptions occur during binder transactions.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
It can help to detect some kind of error, such as why GraphicBuffer::flatten
will crash when handle is null.
Change-Id: I703cd035b96edb7afb324cf24d8230d4e55f4f52
Signed-off-by: Jun Jiang <jun.a.jiang@intel.com>
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Fixes crashing part of bug 11355082.
The driver still leaks references.
Change-Id: Ibc6a63b151c1fc1f7666237f25255ba781e02071
|
| | |\ \
| | | | |
| | | | |
| | | | |
| | | | | |
* commit '5b61ad2cda8ec8ab634ce02f388bb2d3c5ab048d':
Check the padded size of the read byte array
|
| | |\ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* commit 'f0190bff38b6c29abbfc4a877442f71fc3d7dad8':
Add support for writing byte arrays to parcels
|
| | |\ \ \ \
| | | | |_|/
| | | |/| |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* commit 'd1c87d37025c49f6a47fe43328572da495ff04c1':
Binder: Fix some valgrind errors.
Binder: Don't cast directly from a pointer to binder_uintptr_t
Binder: Disable attemptIncStrongHandle
|
| | |\ \ \ \
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
* commit '74be0f7be35e7b40a322fa9a407cb49265333a0b':
binder: fix all warnings
|
| | |\ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
Ib0e5a037,I1bd7c38e,Icfc67c2a,I96c64312,I59528054, ...
* commit '58242fc29881cf29d56ee6e5fde6d73b16d0b67c':
ServiceManager: Implement PING_TRANSACTION
ServiceManager: Use 32/64 bit types from new binder header
Binder: Use 64 bit pointers in 32 processes if selected by the target
Add BINDER_IPC_32BIT to CFLAGS unless TARGET_USES_64_BIT_BINDER is true
Binder: Make binder portable
ServiceManager: Fix the binder interface
ServiceManager: Store handles in uint32_t instead of void *
ServiceManager: Generic Fixes
ServiceManager: Add extra error handling
ServiceManager: Fix Android.mk
ServiceManager: Make use of kernel exported structures
|
|\ \ \ \ \ \ \ \
| |/ / / / / / /
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
byte array
* commit 'ca609e4300d88ad1e815581ebc6a478b446d3882':
Check the padded size of the read byte array
|
| |\ \ \ \ \ \ \
| | | |_|_|_|_|/
| | |/| | | | |
| | | | | | | |
| | | | | | | | |
* commit '38e2aaaa3dd62a20eb211808ae6fe45ec37ee6d5':
Check the padded size of the read byte array
|
| | | |_|_|_|/
| | |/| | | |
| | | | | | |
| | | | | | |
| | | | | | | |
Bug: 13509200
Change-Id: Id93894fcc617ec1cd4ce66921c6e1f1c3cf40b09
|
|\ \ \ \ \ \ \
| |/ / / / / /
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
to parcels
* commit '793be12c0f5a7878d1085e94e58a9c36c84f0911':
Add support for writing byte arrays to parcels
|
| |\ \ \ \ \ \
| | |/ / / / /
| | | | | | |
| | | | | | |
| | | | | | | |
* commit 'b730a45216991cf22c39451c47393b4bccae111b':
Add support for writing byte arrays to parcels
|
| | |/ / / /
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
b/13418320
Change-Id: I2285df9e9d3dc8a6a54055b13b352b81660bf45d
|
|\ \ \ \ \ \
| |/ / / / /
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* commit 'c5294424386bedad2a240074d0845999f28e662d':
Binder: Fix some valgrind errors.
Binder: Don't cast directly from a pointer to binder_uintptr_t
Binder: Disable attemptIncStrongHandle
|
| |\ \ \ \ \
| | | |_|_|/
| | |/| | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* commit 'd1c87d37025c49f6a47fe43328572da495ff04c1':
Binder: Fix some valgrind errors.
Binder: Don't cast directly from a pointer to binder_uintptr_t
Binder: Disable attemptIncStrongHandle
|
| | | |_|/
| | |/| |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
When using 64 bit binder pointers, only initializing the 32 bit
handle, in a stack allocated struct, will pass uninitialized stack
data to the kernel and other processes.
Change-Id: I3432d9d36bb251d8ddb0a863661aeb80aabb3d92
|
|\ \ \ \ \
| |/ / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
to work old binder kernel interface"
* commit '6f286114ec1d597f3dae987bba6e72dbbc404e32':
Revert "Fix "Binder: Make sure binder objects do not overlap" to work old binder kernel interface"
|