ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge "Prevent integer overflow when calculating buffer resizes" into mnc-dev

Browse Source
This commit is contained in:
Christopher Tate 2015-06-10 17:26:43 +00:00 committed by Android (Google) Code Review
commit 2560442a1e
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libs/binder/BufferedTextOutput.cpp
View File

@ -49,9 +49,12 @@ struct BufferedTextOutput::BufferState : public RefBase
status_t append(const char* txt, size_t len) {
if ((len+bufferPos) > bufferSize) {
void* b = realloc(buffer, ((len+bufferPos)*3)/2);
size_t newSize = ((len+bufferPos)*3)/2;
if (newSize < (len+bufferPos)) return NO_MEMORY; // overflow
void* b = realloc(buffer, newSize);
if (!b) return NO_MEMORY;
buffer = (char*)b;
bufferSize = newSize;
}
memcpy(buffer+bufferPos, txt, len);
bufferPos += len;

4
libs/binder/Parcel.cpp
View File

@ -484,7 +484,8 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
if (numObjects > 0) {
// grow objects
if (mObjectsCapacity < mObjectsSize + numObjects) {
int newSize = ((mObjectsSize + numObjects)*3)/2;
size_t newSize = ((mObjectsSize + numObjects)*3)/2;
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
binder_size_t *objects =
(binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
if (objects == (binder_size_t*)0) {
@ -1038,6 +1039,7 @@ restart_write:
}
if (!enoughObjects) {
size_t newSize = ((mObjectsSize+2)*3)/2;
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
if (objects == NULL) return NO_MEMORY;
mObjects = objects;