check negative size before reading Blob
bug: 32071846
Change-Id: Ia5be656c144664753b8d52e4068aa559f3cc2b04
diff --git a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
index 1085a57..91e00b2 100644
--- a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
+++ b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
@@ -69,6 +69,10 @@
return holder;
}
int32_t size = reply.readInt32();
+ if (size < 0) {
+ ALOGE("listProperties, bad blob size %d", size);
+ return holder;
+ }
status = reply.readBlob(size, blob.blob);
if (status != NO_ERROR) {
ALOGE("listProperties, cannot read blob %d", status);
@@ -202,6 +206,10 @@
ReadableBlobHolder blob(new Parcel::ReadableBlob());
ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
int32_t size = data.readInt32();
+ if (size < 0) {
+ ALOGE("setProperty:service, bad blob size %d", size);
+ return BAD_VALUE;
+ }
r = data.readBlob(size, blob.blob);
if (r != NO_ERROR) {
ALOGE("setProperty:service, cannot read blob");