Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / system / libhwbinder / 8e5e47f4604df0b7d529626619e7b70eb9b11adf
commit8e5e47f4604df0b7d529626619e7b70eb9b11adf[log] [tgz]
authorDan Austin <danielaustin@google.com>Thu Sep 10 13:46:02 2015 -0700
committerAlex Deymo <deymo@google.com>Tue Nov 17 17:49:15 2015 -0800
tree86497e513254e0b364ad43b1ed0fbd0264c01f82
parent6d359d5ccc9a2f3f6f89ef2c9c738c2676836d15 [diff]
Benign unsigned integer overflow in Parcel

The realloc case in continueWrite did not update the
gParcelGlobalAllocCount value when an allocation occurred.

In addition, there are conditions that could cause the
gParcelGlobalAllocCount value to be decremented below 0, resulting
in a benign unsigned integer overflow that can cause corrupted values
to be returned through system profiling mechanisms.

BUG: 23972600

(cherry picked from commit 48fd7b457bb0657253d6012e787f50498b32ae42)

Change-Id: I1ad2ac02ab370402481550f6ab8f21fce42455e4
1 file changed
tree: 86497e513254e0b364ad43b1ed0fbd0264c01f82
  1. include/
  2. tests/
  3. Android.mk
  4. AppOpsManager.cpp
  5. Binder.cpp
  6. BpBinder.cpp
  7. BufferedTextOutput.cpp
  8. Debug.cpp
  9. IAppOpsCallback.cpp
  10. IAppOpsService.cpp
  11. IBatteryStats.cpp
  12. IInterface.cpp
  13. IMemory.cpp
  14. IPCThreadState.cpp
  15. IPermissionController.cpp
  16. IProcessInfoService.cpp
  17. IServiceManager.cpp
  18. MemoryBase.cpp
  19. MemoryDealer.cpp
  20. MemoryHeapBase.cpp
  21. Parcel.cpp
  22. PermissionCache.cpp
  23. ProcessInfoService.cpp
  24. ProcessState.cpp
  25. Static.cpp
  26. TextOutput.cpp