ADHOC
/
replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update maxNumber to be smaller. 

There shouldn't be more than 4096 fds (probably signficantly smaller) and
there shouldn't be more than 4096 ints.

Cherry pick of I3a3e50ee3078a4710e9737114e65afc923ed0573

Bug: 18076253
Change-Id: I82a883572b401f115d252dcd3d00aa7252b49b0e
This commit is contained in:
Michael Lentine 2015-02-18 10:14:18 -08:00 committed by Dan Stoza
parent 3be1c6b60a
commit c168b8a5a9
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/ui/GraphicBuffer.cpp
View File

@ -323,7 +323,11 @@ status_t GraphicBuffer::unflatten(
const size_t numFds = static_cast<size_t>(buf[8]);
const size_t numInts = static_cast<size_t>(buf[9]);
const size_t maxNumber = UINT_MAX / sizeof(int);
// Limit the maxNumber to be relatively small. The number of fds or ints
// should not come close to this number, and the number itself was simply
// chosen to be high enough to not cause issues and low enough to prevent
// overflow problems.
const size_t maxNumber = 4096;
if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
width = height = stride = format = usage = 0;
handle = NULL;