Sanity check IMemory access versus underlying mmap am: 94b0d4e3ab am: ef6908e2b3 am: 97f49e50de am: 84f488f354 am: ebdad60d6b am: fc598c54d9 am: f9e5e80bc1 am: 15364d3ec0
am: 049c5df3e5
* commit '049c5df3e59a2d56c47deddc6ec20bf1eba4f50e':
Sanity check IMemory access versus underlying mmap
diff --git a/IMemory.cpp b/IMemory.cpp
index e9891a8..fb8d620 100644
--- a/IMemory.cpp
+++ b/IMemory.cpp
@@ -26,6 +26,7 @@
#include <sys/mman.h>
#include <binder/IMemory.h>
+#include <cutils/log.h>
#include <utils/KeyedVector.h>
#include <utils/threads.h>
#include <utils/Atomic.h>
@@ -187,15 +188,26 @@
if (heap != 0) {
mHeap = interface_cast<IMemoryHeap>(heap);
if (mHeap != 0) {
- mOffset = o;
- mSize = s;
+ size_t heapSize = mHeap->getSize();
+ if (s <= heapSize
+ && o >= 0
+ && (static_cast<size_t>(o) <= heapSize - s)) {
+ mOffset = o;
+ mSize = s;
+ } else {
+ // Hm.
+ android_errorWriteWithInfoLog(0x534e4554,
+ "26877992", -1, NULL, 0);
+ mOffset = 0;
+ mSize = 0;
+ }
}
}
}
}
if (offset) *offset = mOffset;
if (size) *size = mSize;
- return mHeap;
+ return (mSize > 0) ? mHeap : 0;
}
// ---------------------------------------------------------------------------