From fde92eb0ffcc37106d5fe85bf1f1ba30d8639d17 Mon Sep 17 00:00:00 2001 From: Michael Lentine Date: Wed, 18 Feb 2015 10:14:18 -0800 Subject: [PATCH] Update maxNumber to be smaller. There shouldn't be more than 4096 fds (probably signficantly smaller) and there shouldn't be more than 4096 ints. Bug: 18076253 Change-Id: I3a3e50ee3078a4710e9737114e65afc923ed0573 --- libs/ui/GraphicBuffer.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp index 4dff5f16e..46a5a1d61 100644 --- a/libs/ui/GraphicBuffer.cpp +++ b/libs/ui/GraphicBuffer.cpp @@ -250,7 +250,11 @@ status_t GraphicBuffer::unflatten(void const* buffer, size_t size, const size_t numFds = buf[6]; const size_t numInts = buf[7]; - const size_t maxNumber = UINT_MAX / sizeof(int); + // Limit the maxNumber to be relatively small. The number of fds or ints + // should not come close to this number, and the number itself was simply + // chosen to be high enough to not cause issues and low enough to prevent + // overflow problems. + const size_t maxNumber = 4096; if (numFds >= maxNumber || numInts >= (maxNumber - 10)) { width = height = stride = format = usage = 0; handle = NULL;