Prevent integer overflow when calculating buffer resizes
Make sure that we don't go haywire if an exponential buffer growth operation winds up wrapping integer range. Along the way, fix a bookkeeping bug in BufferedTextOutput that would cause it to keep spuriously realloc()ing on every append(). Bug 20674694 Change-Id: Ia845b7de36b90672a151a918ffc26c7da68e20a2
This commit is contained in:
parent
98e67d352b
commit
ed7a50cc7d
|
@ -49,9 +49,12 @@ struct BufferedTextOutput::BufferState : public RefBase
|
||||||
|
|
||||||
status_t append(const char* txt, size_t len) {
|
status_t append(const char* txt, size_t len) {
|
||||||
if ((len+bufferPos) > bufferSize) {
|
if ((len+bufferPos) > bufferSize) {
|
||||||
void* b = realloc(buffer, ((len+bufferPos)*3)/2);
|
size_t newSize = ((len+bufferPos)*3)/2;
|
||||||
|
if (newSize < (len+bufferPos)) return NO_MEMORY; // overflow
|
||||||
|
void* b = realloc(buffer, newSize);
|
||||||
if (!b) return NO_MEMORY;
|
if (!b) return NO_MEMORY;
|
||||||
buffer = (char*)b;
|
buffer = (char*)b;
|
||||||
|
bufferSize = newSize;
|
||||||
}
|
}
|
||||||
memcpy(buffer+bufferPos, txt, len);
|
memcpy(buffer+bufferPos, txt, len);
|
||||||
bufferPos += len;
|
bufferPos += len;
|
||||||
|
|
|
@ -484,7 +484,8 @@ status_t Parcel::appendFrom(const Parcel *parcel, size_t offset, size_t len)
|
||||||
if (numObjects > 0) {
|
if (numObjects > 0) {
|
||||||
// grow objects
|
// grow objects
|
||||||
if (mObjectsCapacity < mObjectsSize + numObjects) {
|
if (mObjectsCapacity < mObjectsSize + numObjects) {
|
||||||
int newSize = ((mObjectsSize + numObjects)*3)/2;
|
size_t newSize = ((mObjectsSize + numObjects)*3)/2;
|
||||||
|
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
|
||||||
binder_size_t *objects =
|
binder_size_t *objects =
|
||||||
(binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
|
(binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
|
||||||
if (objects == (binder_size_t*)0) {
|
if (objects == (binder_size_t*)0) {
|
||||||
|
@ -1038,6 +1039,7 @@ restart_write:
|
||||||
}
|
}
|
||||||
if (!enoughObjects) {
|
if (!enoughObjects) {
|
||||||
size_t newSize = ((mObjectsSize+2)*3)/2;
|
size_t newSize = ((mObjectsSize+2)*3)/2;
|
||||||
|
if (newSize < mObjectsSize) return NO_MEMORY; // overflow
|
||||||
binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
|
binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
|
||||||
if (objects == NULL) return NO_MEMORY;
|
if (objects == NULL) return NO_MEMORY;
|
||||||
mObjects = objects;
|
mObjects = objects;
|
||||||
|
|
Loading…
Reference in New Issue