ADHOC
/
replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent integer overflow when calculating buffer resizes 

Make sure that we don't go haywire if an exponential buffer growth
operation winds up wrapping integer range.  Along the way, fix a
bookkeeping bug in BufferedTextOutput that would cause it to keep
spuriously realloc()ing on every append().

Bug 20674694

Change-Id: Ia845b7de36b90672a151a918ffc26c7da68e20a2
This commit is contained in:
Christopher Tate 2015-06-08 14:45:14 -07:00
parent 98e67d352b
commit ed7a50cc7d
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libs/binder/BufferedTextOutput.cpp
View File

@ -49,9 +49,12 @@ struct BufferedTextOutput::BufferState : public RefBase
status_t append(const char* txt, size_t len) {
if ((len+bufferPos) > bufferSize) {
void* b = realloc(buffer, ((len+bufferPos)*3)/2);
size_t newSize = ((len+bufferPos)*3)/2;
if (newSize < (len+bufferPos)) return NO_MEMORY; // overflow
void* b = realloc(buffer, newSize);
if (!b) return NO_MEMORY;
buffer = (char*)b;
bufferSize = newSize;
}
memcpy(buffer+bufferPos, txt, len);
bufferPos += len;

4
libs/binder/Parcel.cpp
View File

@ -484,7 +484,8 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
if (numObjects > 0) {
// grow objects
if (mObjectsCapacity < mObjectsSize + numObjects) {
int newSize = ((mObjectsSize + numObjects)*3)/2;
size_t newSize = ((mObjectsSize + numObjects)*3)/2;
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
binder_size_t *objects =
(binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
if (objects == (binder_size_t*)0) {
@ -1038,6 +1039,7 @@ restart_write:
}
if (!enoughObjects) {
size_t newSize = ((mObjectsSize+2)*3)/2;
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
if (objects == NULL) return NO_MEMORY;
mObjects = objects;