summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Ceballos <pceballos@google.com>2016-07-13 14:11:57 -0700
committergitbuildkicker <android-build@google.com>2016-07-21 17:34:57 -0700
commit1ecb999624165ea2a9cf5e16b3f7e93358d503d6 (patch)
treec494fafe7b84f986915694a126f1ffed8f56bba4
parent3bcf0caa8cca9143443814b36676b3bae33a4368 (diff)
downloadframeworks_native-1ecb999624165ea2a9cf5e16b3f7e93358d503d6.tar.gz
frameworks_native-1ecb999624165ea2a9cf5e16b3f7e93358d503d6.tar.bz2
frameworks_native-1ecb999624165ea2a9cf5e16b3f7e93358d503d6.zip
Region: Detect malicious overflow in unflatten
Bug 29983260 Change-Id: Ib6e1cb8ae279010c5e9960aaa03513f55b7d873b
-rw-r--r--libs/ui/Region.cpp5
1 files changed, 5 insertions, 0 deletions
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 3810da404..cfed7a984 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@ status_t Region::unflatten(void const* buffer, size_t size) {
return NO_MEMORY;
}
+ if (numRects > (UINT32_MAX / sizeof(Rect))) {
+ android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+ return NO_MEMORY;
+ }
+
Region result;
result.mStorage.clear();
for (size_t r = 0; r < numRects; ++r) {