ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues 7 Pull Requests Releases Wiki Activity

am 38e2aaaa: am 5b61ad2c: Check the padded size of the read byte array

Browse Source 
* commit '38e2aaaa3dd62a20eb211808ae6fe45ec37ee6d5':
  Check the padded size of the read byte array
This commit is contained in:
Kenny Root 2014-03-17 21:31:04 +00:00 committed by Android Git Automerger
commit ca609e4300
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/binder/Parcel.cpp
View File

@ -917,7 +917,8 @@ void Parcel::remove(size_t /*start*/, size_t /*amt*/)
status_t Parcel::read(void* outData, size_t len) const status_t Parcel::read(void* outData, size_t len) const
{ {
if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) { if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize
&& len <= PAD_SIZE(len)) {
memcpy(outData, mData+mDataPos, len); memcpy(outData, mData+mDataPos, len);
mDataPos += PAD_SIZE(len); mDataPos += PAD_SIZE(len);
ALOGV("read Setting data pos of %p to %d\n", this, mDataPos); ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
@ -928,7 +929,8 @@ status_t Parcel::read(void* outData, size_t len) const
const void* Parcel::readInplace(size_t len) const const void* Parcel::readInplace(size_t len) const
{ {
if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) { if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize
&& len <= PAD_SIZE(len)) {
const void* data = mData+mDataPos; const void* data = mData+mDataPos;
mDataPos += PAD_SIZE(len); mDataPos += PAD_SIZE(len);
ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos); ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);