Merge commit 'db5c5bb0259fa024517d9a151726785facba4f02' into HEAD

1 files changed, 5 insertions, 7 deletions

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index cfe6bd2e2e..678d98bc8a 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -412,13 +412,11 @@ size_t Parcel::dataSize() const
 
 size_t Parcel::dataAvail() const
 {
-    // TODO: decide what to do about the possibility that this can
-    // report an available-data size that exceeds a Java int's max
-    // positive value, causing havoc.  Fortunately this will only
-    // happen if someone constructs a Parcel containing more than two
-    // gigabytes of data, which on typical phone hardware is simply
-    // not possible.
-    return dataSize() - dataPosition();
+    size_t result = dataSize() - dataPosition();
+    if (result > INT32_MAX) {
+        abort();
+    }
+    return result;
 }
 
 size_t Parcel::dataPosition() const