Issue #1251 ยป CVE-2015-1474.patch
| libs/ui/GraphicBuffer.cpp | ||
|---|---|---|
|
const size_t numFds = buf[6];
|
||
|
const size_t numInts = buf[7];
|
||
|
const size_t maxNumber = UINT_MAX / sizeof(int);
|
||
|
if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
|
||
|
width = height = stride = format = usage = 0;
|
||
|
handle = NULL;
|
||
|
ALOGE("unflatten: numFds or numInts is too large: %d, %d",
|
||
|
numFds, numInts);
|
||
|
return BAD_VALUE;
|
||
|
}
|
||
|
const size_t sizeNeeded = (8 + numInts) * sizeof(int);
|
||
|
if (size < sizeNeeded) return NO_MEMORY;
|
||
|
size_t fdCountNeeded = 0;
|
||
|
size_t fdCountNeeded = numFds;
|
||
|
if (count < fdCountNeeded) return NO_MEMORY;
|
||
|
if (handle) {
|
||
| ... | ... | |
|
format = buf[4];
|
||
|
usage = buf[5];
|
||
|
native_handle* h = native_handle_create(numFds, numInts);
|
||
|
if (!h) {
|
||
|
width = height = stride = format = usage = 0;
|
||
|
handle = NULL;
|
||
|
ALOGE("unflatten: native_handle_create failed");
|
||
|
return NO_MEMORY;
|
||
|
}
|
||
|
memcpy(h->data, fds, numFds*sizeof(int));
|
||
|
memcpy(h->data + numFds, &buf[8], numInts*sizeof(int));
|
||
|
handle = h;
|
||