From 98e67d352b8805a868ca0e7c2be3ea830fb7c338 Mon Sep 17 00:00:00 2001 From: Christopher Tate Date: Wed, 3 Jun 2015 18:44:15 -0700 Subject: Don't corrupt parcel when writeFileDescriptor() fails We now check for fd-legality before committing binder objects to the flattened data buffer rather than after. Previously we would wind up corrupting the parcel and incurring driver-level errors, as well as potentially leaking FDs. Bug 21428802 Change-Id: Ice0d641b3dcc41fb1b8c68ce2e2ebd744c2863a1 --- libs/binder/Parcel.cpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index bae4eb54f9..2ebf617cf5 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -1013,21 +1013,22 @@ status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData) restart_write: *reinterpret_cast(mData+mDataPos) = val; - // Need to write meta-data? - if (nullMetaData || val.binder != 0) { - mObjects[mObjectsSize] = mDataPos; - acquire_object(ProcessState::self(), val, this); - mObjectsSize++; - } - // remember if it's a file descriptor if (val.type == BINDER_TYPE_FD) { if (!mAllowFds) { + // fail before modifying our object index return FDS_NOT_ALLOWED; } mHasFds = mFdsKnown = true; } + // Need to write meta-data? + if (nullMetaData || val.binder != 0) { + mObjects[mObjectsSize] = mDataPos; + acquire_object(ProcessState::self(), val, this); + mObjectsSize++; + } + return finishWrite(sizeof(flat_binder_object)); } -- cgit v1.2.3-59-g8ed1b