ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

am 1def25a2: Merge commit \'7ac60686\' into manualmerge

Browse source 
* commit '1def25a210ca502a97020efb732775d5c2df2d9a':
  Prevent integer overflow when allocating native_handle_t
This commit is contained in:
Adam Lesinski 2015-05-28 01:03:55 +00:00 • committed by Android Git Automerger
commit 4e83064190
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
libcutils/native_handle.c
View file

@ -25,11 +25,17 @@
#include <cutils/log.h> #include <cutils/log.h>
#include <cutils/native_handle.h> #include <cutils/native_handle.h>
static const int kMaxNativeFds = 1024;
static const int kMaxNativeInts = 1024;
native_handle_t* native_handle_create(int numFds, int numInts) native_handle_t* native_handle_create(int numFds, int numInts)
{ {
native_handle_t* h = malloc( if (numFds < 0 || numInts < 0 || numFds > kMaxNativeFds || numInts > kMaxNativeInts) {
sizeof(native_handle_t) + sizeof(int)*(numFds+numInts)); return NULL;
}
size_t mallocSize = sizeof(native_handle_t) + (sizeof(int) * (numFds + numInts));
native_handle_t* h = malloc(mallocSize);
if (h) { if (h) {
h->version = sizeof(native_handle_t); h->version = sizeof(native_handle_t);
h->numFds = numFds; h->numFds = numFds;