ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ui: Fix bad size check in Fence::unflatten

Browse Source 
Differs slightly from mnc+ patch: GetFlattenedSize was fixed in mnc.

Test: Boot device, run poc from bug, observe no longer crashes
Bug: 37285689
AOSP-Change-Id: Id8b851733b088cce0d07493fbf76e7e24f9299ad
(cherry picked from commit 9809602ac32dcb7bceaa5bc34df5b7fb68aacd38)

CVE-2017-0666

Change-Id: I778c82b363ca0409d534f255cc5d17b39e751986
This commit is contained in:
Chris Forbes 2017-05-10 13:12:00 -07:00 committed by MSe
parent c5fe5044f4
commit a3a09ef6b4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libs/ui/Fence.cpp
View File

@ -157,7 +157,7 @@ status_t Fence::unflatten(void const*& buffer, size_t& size, int const*& fds, si
return INVALID_OPERATION;
}
if (size < 1) {
if (size < getFlattenedSize()) {
return NO_MEMORY;
}