diff options
author | Steven Moreland <smoreland@google.com> | 2022-03-08 19:57:23 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2022-03-08 19:57:23 +0000 |
commit | 2ffd44fb8d76df8c5e0f9832bc8e731c842f2d03 (patch) | |
tree | 50418c247ca2ddb3a7eb6948572efbc7d12136e6 | |
parent | 04da93f53db5c8e4673b2146e356b8bf443f29f3 (diff) | |
parent | bfbbb04c096deccf43ad1c52e80c399a7be985ed (diff) | |
download | libhwbinder-2ffd44fb8d76df8c5e0f9832bc8e731c842f2d03.tar.gz |
Merge "libhwbinder: kernel check also in userspace" am: 8b95307fc7 am: 0d37d37576 am: defd5b394d am: bfbbb04c09aml_tz4_332714070aml_tz4_332714050aml_tz4_332714010aml_tz4_331910000aml_tz4_331314030aml_tz4_331314020aml_tz4_331314010aml_tz4_331012050aml_tz4_331012040aml_tz4_331012000aml_ase_331311020aml_ase_331112000aml_ase_331011020android13-mainline-tzdata4-releaseandroid13-mainline-appsearch-releaseaml_tz4_332714010
Original change: https://android-review.googlesource.com/c/platform/system/libhwbinder/+/2014695
Change-Id: I53152dd666479c1d17745a5c3e7f98989f229771
-rw-r--r-- | Parcel.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
@@ -1333,11 +1333,17 @@ bool Parcel::verifyBufferObject(const binder_buffer_object *buffer_obj, return false; } if (buffer_obj->parent_offset != parentOffset) { - ALOGE("Buffer parent offset %" PRIu64 " does not match expected offset %zu.", + ALOGE("Buffer parent offset %" PRIu64 " does not match expected offset %zu.", static_cast<uint64_t>(buffer_obj->parent_offset), parentOffset); return false; } + // checked by kernel driver, but needed for fuzzer + if (parent >= mObjectsSize) { + ALOGE("Parent index %zu but only have %zu objects", parent, mObjectsSize); + return false; + } + binder_buffer_object *parentBuffer = reinterpret_cast<binder_buffer_object*>(mData + mObjects[parent]); void* bufferInParent = *reinterpret_cast<void**>( |