diff options
| author | Chia-I Wu <olv@google.com> | 2018-10-09 15:22:46 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-10-19 16:24:13 +0000 |
| commit | e6eb42cb2e57747e52e488d54da314bc6eabb546 (patch) | |
| tree | 640eda727e648a7aeaa7ab8fb6254575081e504d | |
| parent | e31f6eb5c49e0e638585243ac36ce139b60a6fb1 (diff) | |
| download | android_frameworks_native-e6eb42cb2e57747e52e488d54da314bc6eabb546.tar.gz android_frameworks_native-e6eb42cb2e57747e52e488d54da314bc6eabb546.tar.bz2 android_frameworks_native-e6eb42cb2e57747e52e488d54da314bc6eabb546.zip | |
libui: add boundary check to GraphicBuffer::unflatten
Commit cb496acbe593326e8d5d563847067d02b2df40ec removed the boundary
check by accident.
Bug: 114223584
Test: manual
Change-Id: I057bc02d5807e438530d1a5327c2e02b9d154151
(cherry picked from commit bf8d7210c4bbbdc875e9695a301cdf9c3b544279)
| -rw-r--r-- | libs/ui/GraphicBuffer.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp index c8805000a..6235bd6cc 100644 --- a/libs/ui/GraphicBuffer.cpp +++ b/libs/ui/GraphicBuffer.cpp @@ -372,6 +372,10 @@ status_t GraphicBuffer::flatten(void*& buffer, size_t& size, int*& fds, size_t& status_t GraphicBuffer::unflatten( void const*& buffer, size_t& size, int const*& fds, size_t& count) { + if (size < 12 * sizeof(int)) { + android_errorWriteLog(0x534e4554, "114223584"); + return NO_MEMORY; + } int const* buf = static_cast<int const*>(buffer); |