commit 83569f3fd9f6f91705addcadcf20a45f6e474688
author TreeHugger Robot <treehugger-gerrit@google.com> Tue Oct 11 17:12:35 2016 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Tue Oct 11 17:12:35 2016 +0000
tree 57f30c504c5092974c8cfcd2532de4a88e8187e5
parent 20539ba755c19cde7924f8880a0ab2674fb0dc46
parent 6dcc50beade1a6e4213efa578057af550b10ac96

Merge "fix synchronization in PM and PowerHal" into nyc-car-dev

libvehiclenetwork/native/IVehicleNetwork.cpp

diff --git a/libvehiclenetwork/native/IVehicleNetwork.cpp b/libvehiclenetwork/native/IVehicleNetwork.cpp
index eb126cd..f8ba297 100644
--- a/libvehiclenetwork/native/IVehicleNetwork.cpp
+++ b/libvehiclenetwork/native/IVehicleNetwork.cpp
@@ -77,6 +77,10 @@
                 return holder;
             }
             int32_t size = reply.readInt32();
+            if (size < 0) {
+                ALOGE("listProperties, bad blob size %d", size);
+                return holder;
+            }
             status = reply.readBlob(size, blob.blob);
             if (status != NO_ERROR) {
                 ALOGE("listProperties, cannot read blob %d", status);
@@ -400,6 +404,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("injectEvent:service, bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("injectEvent:service, cannot read blob");

libvehiclenetwork/native/IVehicleNetworkHalMock.cpp

diff --git a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
index 1085a57..91e00b2 100644
--- a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
+++ b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
@@ -69,6 +69,10 @@
                 return holder;
             }
             int32_t size = reply.readInt32();
+            if (size < 0) {
+                ALOGE("listProperties, bad blob size %d", size);
+                return holder;
+            }
             status = reply.readBlob(size, blob.blob);
             if (status != NO_ERROR) {
                 ALOGE("listProperties, cannot read blob %d", status);
@@ -202,6 +206,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("setProperty:service, bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("setProperty:service, cannot read blob");

libvehiclenetwork/native/IVehicleNetworkListener.cpp

diff --git a/libvehiclenetwork/native/IVehicleNetworkListener.cpp b/libvehiclenetwork/native/IVehicleNetworkListener.cpp
index cd79515..565c51d 100644
--- a/libvehiclenetwork/native/IVehicleNetworkListener.cpp
+++ b/libvehiclenetwork/native/IVehicleNetworkListener.cpp
@@ -112,6 +112,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("onEvents: bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("onEvents: cannot read blob");

libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp

diff --git a/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp b/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
index fc283ea..c79164c 100644
--- a/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
+++ b/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
@@ -626,6 +626,10 @@
     ReadableBlobHolder blob(new Parcel::ReadableBlob());
     ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
     int32_t size = parcel.readInt32();
+    if (size < 0) {
+        ALOGE("readFromParcel, bad blob size %d", size);
+        return BAD_VALUE;
+    }
     status_t status = parcel.readBlob(size, blob.blob);
     if (status != NO_ERROR) {
         ALOGE("readFromParcel, cannot read blob");