commit 953c05276e5b50a437d5d6f3bc7b9a4b0941d702
author Christopher Tate <ctate@google.com> Tue Dec 06 00:13:48 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Dec 06 00:13:48 2016 +0000
tree 8712dfd4670b4e7da1fe8dec1249ca2b4182133f
parent 57dbf1c224be67afc296ef97b70b6a13647d4c83
parent 02e4440eabb004f8d817599b68caf9dba7aa27bc

resolve merge conflicts of 13c5c34 to mnc-dev am: 79b74d787d am: abe293b950
am: 02e4440eab

Change-Id: I66e7e982176555f09bf298325754d708ef0ecac0

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index d40b09c..c7987df 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -521,7 +521,7 @@
         // grow objects
         if (mObjectsCapacity < mObjectsSize + numObjects) {
             size_t newSize = ((mObjectsSize + numObjects)*3)/2;
-            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
             binder_size_t *objects =
                 (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
             if (objects == (binder_size_t*)0) {
@@ -1073,7 +1073,7 @@
     }
     if (!enoughObjects) {
         size_t newSize = ((mObjectsSize+2)*3)/2;
-        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
         binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
         if (objects == NULL) return NO_MEMORY;
         mObjects = objects;