commit 363247929c35104b3e5ee9e637e9dcf579080aee
author Pablo Ceballos <pceballos@google.com> Wed Jul 13 14:11:57 2016 -0700
committer gitbuildkicker <android-build@google.com> Mon Aug 01 19:13:30 2016 -0700
tree 5154e3ff11f0b2b76bfb0430f73adacf5dcb3ba3
parent 1f4b49e64adf4623eefda503bca61e253597b9bf

Region: Detect malicious overflow in unflatten

Bug 29983260

Change-Id: Ib6e1cb8ae279010c5e9960aaa03513f55b7d873b

libs/ui/Region.cpp

diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index ac37990..ee152bf 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -795,6 +795,11 @@
         return NO_MEMORY;
     }
 
+    if (numRects > (UINT32_MAX / sizeof(Rect))) {
+        android_errorWriteWithInfoLog(0x534e4554, "29983260", -1, NULL, 0);
+        return NO_MEMORY;
+    }
+
     Region result;
     result.mStorage.clear();
     for (size_t r = 0; r < numRects; ++r) {