From 29d8cf91bed3c9f72a97046655bc3bdc05952d3a Mon Sep 17 00:00:00 2001 From: Riley Andrews Date: Mon, 12 Jan 2015 18:16:29 -0800 Subject: [PATCH] Replace all instances of intptr_t with uintptr_t. When compiling 32 bit binaries against a 64 bit binder interface, implicit promotions of intptr_t types to uint64_t for fields in the binder ioctl structures can result in invalid pointers because of sign extension. --- libs/binder/tests/binderDriverInterfaceTest.cpp | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/libs/binder/tests/binderDriverInterfaceTest.cpp b/libs/binder/tests/binderDriverInterfaceTest.cpp index 64a6c9133..315f34956 100644 --- a/libs/binder/tests/binderDriverInterfaceTest.cpp +++ b/libs/binder/tests/binderDriverInterfaceTest.cpp @@ -58,7 +58,7 @@ class BinderDriverInterfaceTestEnv : public ::testing::Environment { BC_ENTER_LOOPER, }; struct binder_write_read bwr = binder_write_read(); - bwr.write_buffer = (intptr_t)bc; + bwr.write_buffer = (uintptr_t)bc; bwr.write_size = sizeof(bc); ret = ioctl(m_binderFd, BINDER_WRITE_READ, &bwr); EXPECT_EQ(0, ret); @@ -111,7 +111,7 @@ class BinderDriverInterfaceTest : public ::testing::Test { uint32_t br[32]; struct binder_write_read bwr = binder_write_read(); SCOPED_TRACE("TestReadEmpty"); - bwr.read_buffer = (intptr_t)br; + bwr.read_buffer = (uintptr_t)br; bwr.read_size = sizeof(br); binderTestIoctlErr1(BINDER_WRITE_READ, &bwr, EAGAIN); EXPECT_EQ(0u, bwr.read_consumed); @@ -206,7 +206,7 @@ TEST_F(BinderDriverInterfaceTest, IncRefsAcquireReleaseDecRefs) { 0, }; struct binder_write_read bwr = binder_write_read(); - bwr.write_buffer = (intptr_t)bc; + bwr.write_buffer = (uintptr_t)bc; bwr.write_size = sizeof(bc); binderTestIoctl(BINDER_WRITE_READ, &bwr); EXPECT_EQ(sizeof(bc), bwr.write_consumed); @@ -241,9 +241,9 @@ TEST_F(BinderDriverInterfaceTest, Transaction) { } __attribute__((packed)) br; struct binder_write_read bwr = binder_write_read(); - bwr.write_buffer = (intptr_t)&bc1; + bwr.write_buffer = (uintptr_t)&bc1; bwr.write_size = sizeof(bc1); - bwr.read_buffer = (intptr_t)&br; + bwr.read_buffer = (uintptr_t)&br; bwr.read_size = sizeof(br); { @@ -283,7 +283,7 @@ TEST_F(BinderDriverInterfaceTest, Transaction) { .arg1 = br.arg2.data.ptr.buffer, }; - bwr.write_buffer = (intptr_t)&bc2; + bwr.write_buffer = (uintptr_t)&bc2; bwr.write_size = sizeof(bc2); bwr.write_consumed = 0; bwr.read_size = 0; @@ -329,9 +329,9 @@ TEST_F(BinderDriverInterfaceTest, RequestDeathNotification) { } __attribute__((packed)) br; struct binder_write_read bwr = binder_write_read(); - bwr.write_buffer = (intptr_t)&bc; + bwr.write_buffer = (uintptr_t)&bc; bwr.write_size = sizeof(bc); - bwr.read_buffer = (intptr_t)&br; + bwr.read_buffer = (uintptr_t)&br; bwr.read_size = sizeof(br); binderTestIoctl(BINDER_WRITE_READ, &bwr);