summaryrefslogtreecommitdiff
path: root/libs/ui/Region.cpp
diff options
context:
space:
mode:
author Bill Yi <byi@google.com> 2016-12-06 15:07:48 -0800
committer Bill Yi <byi@google.com> 2016-12-06 15:07:48 -0800
commitecea1bfeae1211f9a363925c172c0f23062107fb (patch)
tree99d7fc7c78f261a3ffde997e8354f8134c60bfbe /libs/ui/Region.cpp
parentf5c3b20f062ca646572ee6c07713eba691971c95 (diff)
parent6079aa6a8a845d8312435fe3e991bbe14588d018 (diff)
Merge remote-tracking branch 'goog/stage-aosp-master' into HEAD
Diffstat (limited to 'libs/ui/Region.cpp')
-rw-r--r--libs/ui/Region.cpp5
1 files changed, 5 insertions, 0 deletions
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index a430a31058..b53c563624 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -796,6 +796,11 @@ status_t Region::unflatten(void const* buffer, size_t size) {
return NO_MEMORY;
}
+ if (numRects > (UINT32_MAX / sizeof(Rect))) {
+ android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+ return NO_MEMORY;
+ }
+
Region result;
result.mStorage.clear();
for (size_t r = 0; r < numRects; ++r) {