diff options
| author | 2022-07-09 00:31:04 +0000 | |
|---|---|---|
| committer | 2022-07-09 00:31:04 +0000 | |
| commit | 80495c92a8ccdba11a5155ba641758aa7c702102 (patch) | |
| tree | 5735c9a464667e7a57a6ac96f3a9b705a3239d9b | |
| parent | c2834f88ca7b124a65a69d99a85d375092eaef9e (diff) | |
| parent | e43e5bea0f207f4354f8ec86e147ffe639f80d6d (diff) | |
Merge "libbinder: Fix out-of-bounds abort in RpcServer" am: 09ba064c13 am: e43e5bea0f
Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2146845
Change-Id: I02834ea5aabfd40dbf7305a5d2cd305fa00e3e5a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | libs/binder/RpcServer.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libs/binder/RpcServer.cpp b/libs/binder/RpcServer.cpp index ee90710078..096d5cc5ad 100644 --- a/libs/binder/RpcServer.cpp +++ b/libs/binder/RpcServer.cpp @@ -421,7 +421,9 @@ void RpcServer::establishConnection(sp<RpcServer>&& server, base::unique_fd clie session->setMaxIncomingThreads(server->mMaxThreads); if (!session->setProtocolVersion(protocolVersion)) return; - if (server->mSupportedFileDescriptorTransportModes.test( + if (header.fileDescriptorTransportMode < + server->mSupportedFileDescriptorTransportModes.size() && + server->mSupportedFileDescriptorTransportModes.test( header.fileDescriptorTransportMode)) { session->setFileDescriptorTransportMode( static_cast<RpcSession::FileDescriptorTransportMode>( |