commit eba7afcc14f55e7fd32db9254f2b186108e1c776
author Christopher Tate <ctate@google.com> Thu Jul 02 01:28:56 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Jul 02 01:28:56 2015 +0000
tree dee03577fe47dd8f6e426108bb2e23a505afeda6
parent 8728c390476110857dd6b290dac3bfdf13b33e81
parent 2f340be345612d9fc2ecb1ea2a4c9e147610a593

am 2f340be3: Disregard alleged binder entities beyond parcel bounds

* commit '2f340be345612d9fc2ecb1ea2a4c9e147610a593':
  Disregard alleged binder entities beyond parcel bounds

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 99c934c..87ce5d0 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -411,7 +411,7 @@
     // Count objects in range
     for (int i = 0; i < (int) size; i++) {
         size_t off = objects[i];
-        if ((off >= offset) && (off < offset + len)) {
+        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
             if (firstIndex == -1) {
                 firstIndex = i;
             }