commit 9b6094e791d781e219a52d7615b7798b4ef9def9
author Christopher Tate <ctate@google.com> Thu Nov 03 13:32:41 2016 -0700
committer Adam Seaton <aseaton@google.com> Mon Dec 19 21:08:26 2016 +0000
tree 42b5b56f09da138712bb0c62ba94603f1d6585c5
parent cb7eff6a34f6a276d798669a206661c248e2bcb2

Correct overflow check in Parcel resize code

Fix merge conflict into nyc-mr1-security-d-release
Bug 31929765

Change-Id: Ie27b9945f1de056624668869bdf9a5578abff467
(cherry picked from commit 65dd433f0db2fe402dc725f7012c6e26769b3224)

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index e88ae29..19ce3eb 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -548,7 +548,7 @@
         // grow objects
         if (mObjectsCapacity < mObjectsSize + numObjects) {
             size_t newSize = ((mObjectsSize + numObjects)*3)/2;
-            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
             binder_size_t *objects =
                 (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
             if (objects == (binder_size_t*)0) {
@@ -1342,7 +1342,7 @@
     }
     if (!enoughObjects) {
         size_t newSize = ((mObjectsSize+2)*3)/2;
-        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
         binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
         if (objects == NULL) return NO_MEMORY;
         mObjects = objects;