Region: Detect malicious overflow in unflatten
Bug 29983260
Change-Id: Ib6e1cb8ae279010c5e9960aaa03513f55b7d873b
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index ac37990..ee152bf 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@
return NO_MEMORY;
}
+ if (numRects > (UINT32_MAX / sizeof(Rect))) {
+ android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+ return NO_MEMORY;
+ }
+
Region result;
result.mStorage.clear();
for (size_t r = 0; r < numRects; ++r) {