Verify that the native handle was created
The inputs to native_handle_create can cause an overflowed allocation,
so check the return value of native_handle_create before accessing
the memory it returns.
Bug:19334482
Change-Id: I1f489382776c2a1390793a79dc27ea17baa9b2a2
(cherry picked from commit eaac99a717
)
This commit is contained in:
parent
da9fd70de1
commit
4ff0cb4404
@ -1144,6 +1144,10 @@ native_handle* Parcel::readNativeHandle() const
|
||||
if (err != NO_ERROR) return 0;
|
||||
|
||||
native_handle* h = native_handle_create(numFds, numInts);
|
||||
if (!h) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
|
||||
h->data[i] = dup(readFileDescriptor());
|
||||
if (h->data[i] < 0) err = BAD_VALUE;
|
||||
|
Loading…
Reference in New Issue
Block a user