replicant-frameworks_native/libs/binder
Nick Kralevich b6b1423c87 Parcel.cpp: reject size_t arguments greater than INT32_MAX
It's a security best practice for size_t values to be rejected if
they are greater than INT32_SIZE. This is intended to prevent the
common error of inadvertently passing a negative int value to a
function, which after conversion to an unsigned type, becomes a huge
number, defeating the purpose of bounds checking.

This patch also addresses a bug where the call to:
  Parcel::write(buf, (size_t) -1);
would call writeInPlace() which uses PAD_SIZE on the supplied
argument. This would then cause an integer overflow, with PAD_SIZE
returning a small value, but the memcpy in Parcel::write using the
old large length value.

Bug: 19573085
Change-Id: Ib11bfb3dae4f3be91cd17b2c676926700972c7b8
2015-04-02 10:56:12 -07:00
..
tests Replace all instances of intptr_t with uintptr_t. 2015-01-13 21:59:44 +00:00
Android.mk Add ProcessInfoService to activity manager. 2015-02-02 14:56:55 -08:00
AppOpsManager.cpp
Binder.cpp
BpBinder.cpp
BufferedTextOutput.cpp
Debug.cpp
IAppOpsCallback.cpp
IAppOpsService.cpp
IBatteryStats.cpp
IInterface.cpp Add backwards compatible versions of IInterface::asBinder() 2015-03-31 20:32:30 +00:00
IMemory.cpp
IPCThreadState.cpp Kill HAVE_PTHREADS. 2015-01-26 22:36:36 -08:00
IPermissionController.cpp
IProcessInfoService.cpp Add ProcessInfoService to activity manager. 2015-02-02 14:56:55 -08:00
IServiceManager.cpp
MemoryBase.cpp
MemoryDealer.cpp
MemoryHeapBase.cpp
Parcel.cpp Parcel.cpp: reject size_t arguments greater than INT32_MAX 2015-04-02 10:56:12 -07:00
PermissionCache.cpp
ProcessInfoService.cpp Add ProcessInfoService to activity manager. 2015-02-02 14:56:55 -08:00
ProcessState.cpp
Static.cpp
TextOutput.cpp