commit 20a7a7d5b41bede561cf6140757acc655b2c743b
author Martijn Coenen <maco@google.com> Wed Apr 04 11:46:56 2018 +0200
committer android-build-team Robot <android-build-team-robot@google.com> Fri Sep 14 20:46:02 2018 +0000
tree c14653dacc7a14686b9f5aff867f40e89de96eef
parent 26f4de9147ab4a5b436350c56eb2a198e7dd0d20

Don't pad before calling writeInPlace().

writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.

Bug: 77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44

(cherry picked from commit f8542381b72a7bb2452a5278a00ca8c34edbf8a0)
(cherry picked from commit 732132b765cd7b667f16cf32f0fe4c852d7d44dd)

Change-Id: Ic9ecef0e5e718bce2d91d7974632d5933ca2d715

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index cc9f687..e5a34c2 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1285,7 +1285,7 @@
     if (err) return err;
 
     // payload
-    void* const buf = this->writeInplace(pad_size(len));
+    void* const buf = this->writeInplace(len);
     if (buf == NULL)
         return BAD_VALUE;