From ae33effd43a615183f089f0a216b5965e8104842 Mon Sep 17 00:00:00 2001 From: Michael Lentine Date: Fri, 31 Oct 2014 11:10:13 -0700 Subject: [PATCH] Fix crash when user provides large values in the Parcel. Bug: 18102648 Change-Id: Ie6a24718e586a34424238363de80f9545951514f (cherry-picked from commit 8afa1c4ab86d724feb7716e153b7835385534590) --- libs/gui/ISurfaceComposer.cpp | 14 ++++++++++++-- libs/gui/LayerState.cpp | 8 ++++++-- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp index 669755a86..bc4baa3ee 100644 --- a/libs/gui/ISurfaceComposer.cpp +++ b/libs/gui/ISurfaceComposer.cpp @@ -312,19 +312,29 @@ status_t BnSurfaceComposer::onTransact( case SET_TRANSACTION_STATE: { CHECK_INTERFACE(ISurfaceComposer, data, reply); size_t count = data.readInt32(); + if (count > data.dataSize()) { + return BAD_VALUE; + } ComposerState s; Vector state; state.setCapacity(count); for (size_t i=0 ; i data.dataSize()) { + return BAD_VALUE; + } DisplayState d; Vector displays; displays.setCapacity(count); for (size_t i=0 ; i( - input.readInplace(sizeof(layer_state_t::matrix22_t))); + const void* matrix_data = input.readInplace(sizeof(layer_state_t::matrix22_t)); + if (matrix_data) { + matrix = *reinterpret_cast(matrix_data); + } else { + return BAD_VALUE; + } input.read(crop); input.read(transparentRegion); return NO_ERROR;