Skip to content
Snippets Groups Projects
Commit 07edc3b3 authored by Adam Lesinski's avatar Adam Lesinski
Browse files

Prevent integer overflow when allocating native_handle_t

User specified values of numInts and numFds can overflow
and cause malloc to allocate less than we expect, causing
heap corruption in subsequent operations on the allocation.

Bug: 19334482
Change-Id: I43c75f536ea4c08f14ca12ca6288660fd2d1ec55
parent eb19e766
No related branches found
No related tags found
No related merge requests found
......@@ -25,11 +25,17 @@
#include <cutils/log.h>
#include <cutils/native_handle.h>
static const int kMaxNativeFds = 1024;
static const int kMaxNativeInts = 1024;
native_handle_t* native_handle_create(int numFds, int numInts)
{
native_handle_t* h = malloc(
sizeof(native_handle_t) + sizeof(int)*(numFds+numInts));
if (numFds < 0 || numInts < 0 || numFds > kMaxNativeFds || numInts > kMaxNativeInts) {
return NULL;
}
size_t mallocSize = sizeof(native_handle_t) + (sizeof(int) * (numFds + numInts));
native_handle_t* h = malloc(mallocSize);
if (h) {
h->version = sizeof(native_handle_t);
h->numFds = numFds;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment