am ca609e43: am 38e2aaaa: am 5b61ad2c: Check the padded size of the read byte array
* commit 'ca609e4300d88ad1e815581ebc6a478b446d3882':
Check the padded size of the read byte array
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 3f38713..4298522 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -943,7 +943,8 @@
status_t Parcel::read(void* outData, size_t len) const
{
- if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {
+ if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize
+ && len <= PAD_SIZE(len)) {
memcpy(outData, mData+mDataPos, len);
mDataPos += PAD_SIZE(len);
ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
@@ -954,7 +955,8 @@
const void* Parcel::readInplace(size_t len) const
{
- if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize) {
+ if ((mDataPos+PAD_SIZE(len)) >= mDataPos && (mDataPos+PAD_SIZE(len)) <= mDataSize
+ && len <= PAD_SIZE(len)) {
const void* data = mData+mDataPos;
mDataPos += PAD_SIZE(len);
ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);