commit 134fd91bccde911bf9497f09841ec9922bbefec9
author Christopher Tate <ctate@google.com> Thu Jul 02 01:55:43 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Jul 02 01:55:43 2015 +0000
tree 2a5380c2686553e2b987bee8cf76b256455209fb
parent 209ea40e8f3ccda405cd4e99c768b9b9b43e9dfa
parent 708b42e0ee5ad97b8426a6245f73131ddfc59a33

am 708b42e0: am eba7afcc: am 2f340be3: Disregard alleged binder entities beyond parcel bounds

* commit '708b42e0ee5ad97b8426a6245f73131ddfc59a33':
  Disregard alleged binder entities beyond parcel bounds

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index b2a4aae..d769caa 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -411,7 +411,7 @@
     // Count objects in range
     for (int i = 0; i < (int) size; i++) {
         size_t off = objects[i];
-        if ((off >= offset) && (off < offset + len)) {
+        if ((off >= offset) && (off + sizeof(flat_binder_object) <= offset + len)) {
             if (firstIndex == -1) {
                 firstIndex = i;
             }