diff options
| author | 2016-02-17 19:35:38 +0000 | |
|---|---|---|
| committer | 2016-02-17 19:35:38 +0000 | |
| commit | 049c5df3e59a2d56c47deddc6ec20bf1eba4f50e (patch) | |
| tree | 74923aed125bff73e1bd1abff7a9e673439161dd | |
| parent | a20eb797c462189ba6641308d80e638501db0a18 (diff) | |
| parent | 15364d3ec0fda521cd796fc28a2a8d6a68e2cf95 (diff) | |
Sanity check IMemory access versus underlying mmap am: 94b0d4e3ab am: ef6908e2b3 am: 97f49e50de am: 84f488f354 am: ebdad60d6b am: fc598c54d9 am: f9e5e80bc1
am: 15364d3ec0
* commit '15364d3ec0fda521cd796fc28a2a8d6a68e2cf95':
Sanity check IMemory access versus underlying mmap
| -rw-r--r-- | libs/binder/IMemory.cpp | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/libs/binder/IMemory.cpp b/libs/binder/IMemory.cpp index e9891a830d..fb8d620b4c 100644 --- a/libs/binder/IMemory.cpp +++ b/libs/binder/IMemory.cpp @@ -26,6 +26,7 @@ #include <sys/mman.h> #include <binder/IMemory.h> +#include <cutils/log.h> #include <utils/KeyedVector.h> #include <utils/threads.h> #include <utils/Atomic.h> @@ -187,15 +188,26 @@ sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const if (heap != 0) { mHeap = interface_cast<IMemoryHeap>(heap); if (mHeap != 0) { - mOffset = o; - mSize = s; + size_t heapSize = mHeap->getSize(); + if (s <= heapSize + && o >= 0 + && (static_cast<size_t>(o) <= heapSize - s)) { + mOffset = o; + mSize = s; + } else { + // Hm. + android_errorWriteWithInfoLog(0x534e4554, + "26877992", -1, NULL, 0); + mOffset = 0; + mSize = 0; + } } } } } if (offset) *offset = mOffset; if (size) *size = mSize; - return mHeap; + return (mSize > 0) ? mHeap : 0; } // --------------------------------------------------------------------------- |