summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--libs/ui/GraphicBuffer.cpp6
1 files changed, 5 insertions, 1 deletions
diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp
index 48b85d1c7..4c46deb6d 100644
--- a/libs/ui/GraphicBuffer.cpp
+++ b/libs/ui/GraphicBuffer.cpp
@@ -343,7 +343,11 @@ status_t GraphicBuffer::unflatten(
const size_t numFds = buf[8];
const size_t numInts = buf[9];
- const size_t maxNumber = UINT_MAX / sizeof(int);
+ // Limit the maxNumber to be relatively small. The number of fds or ints
+ // should not come close to this number, and the number itself was simply
+ // chosen to be high enough to not cause issues and low enough to prevent
+ // overflow problems.
+ const size_t maxNumber = 4096;
if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
width = height = stride = format = usage = 0;
handle = NULL;