commit | 20539ba755c19cde7924f8880a0ab2674fb0dc46 | [log] [tgz] |
---|---|---|
author | Keun-young Park <keunyoung@google.com> | Mon Oct 10 17:57:34 2016 -0700 |
committer | Keun-young Park <keunyoung@google.com> | Mon Oct 10 17:57:34 2016 -0700 |
tree | 3b96b0f9cf810f50c1aae764e42aeb05be083a35 | |
parent | ac9a1546f95d683650e8d15f414fadaab40ffe7b [diff] [blame] |
check negative size before reading Blob bug: 32071846 Change-Id: Ia5be656c144664753b8d52e4068aa559f3cc2b04
diff --git a/libvehiclenetwork/native/IVehicleNetworkListener.cpp b/libvehiclenetwork/native/IVehicleNetworkListener.cpp index cd79515..565c51d 100644 --- a/libvehiclenetwork/native/IVehicleNetworkListener.cpp +++ b/libvehiclenetwork/native/IVehicleNetworkListener.cpp
@@ -112,6 +112,10 @@ ReadableBlobHolder blob(new Parcel::ReadableBlob()); ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY); int32_t size = data.readInt32(); + if (size < 0) { + ALOGE("onEvents: bad blob size %d", size); + return BAD_VALUE; + } r = data.readBlob(size, blob.blob); if (r != NO_ERROR) { ALOGE("onEvents: cannot read blob");