Binder: Make sure binder objects do not overlap
Fixes crashing part of bug 11355082.
The driver still leaks references.
Change-Id: Ibc6a63b151c1fc1f7666237f25255ba781e02071
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 38e019c..882130f 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -35,6 +35,7 @@
#include <private/binder/binder_module.h>
+#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
@@ -1317,6 +1318,7 @@
void Parcel::ipcSetDataReference(const uint8_t* data, size_t dataSize,
const size_t* objects, size_t objectsCount, release_func relFunc, void* relCookie)
{
+ binder_size_t minOffset = 0;
freeDataNoInit();
mError = NO_ERROR;
mData = const_cast<uint8_t*>(data);
@@ -1329,6 +1331,16 @@
mNextObjectHint = 0;
mOwner = relFunc;
mOwnerCookie = relCookie;
+ for (size_t i = 0; i < mObjectsSize; i++) {
+ binder_size_t offset = mObjects[i];
+ if (offset < minOffset) {
+ ALOGE("%s: bad object offset %"PRIu64" < %"PRIu64"\n",
+ __func__, (uint64_t)offset, (uint64_t)minOffset);
+ mObjectsSize = 0;
+ break;
+ }
+ minOffset = offset + sizeof(flat_binder_object);
+ }
scanForFds();
}