commit e37a4dc7c479574f5210458c083fd7c98a704e20
author Christopher Tate <ctate@google.com> Tue Dec 06 00:17:19 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Dec 06 00:17:19 2016 +0000
tree 62c117ba9ccd77d82afcdc186f282645ab244618
parent e81a4f15185486cd67ff8983f9826d42ef653088
parent 953c05276e5b50a437d5d6f3bc7b9a4b0941d702

resolve merge conflicts of 13c5c34 to mnc-dev am: 79b74d787d am: abe293b950 am: 02e4440eab
am: 953c05276e

Change-Id: If6e16f080e701171d7c9b69adbeaab3a6910b63a

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index e88ae29..19ce3eb 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -548,7 +548,7 @@
         // grow objects
         if (mObjectsCapacity < mObjectsSize + numObjects) {
             size_t newSize = ((mObjectsSize + numObjects)*3)/2;
-            if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+            if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
             binder_size_t *objects =
                 (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
             if (objects == (binder_size_t*)0) {
@@ -1342,7 +1342,7 @@
     }
     if (!enoughObjects) {
         size_t newSize = ((mObjectsSize+2)*3)/2;
-        if (newSize < mObjectsSize) return NO_MEMORY;   // overflow
+        if (newSize*sizeof(binder_size_t) < mObjectsSize) return NO_MEMORY;   // overflow
         binder_size_t* objects = (binder_size_t*)realloc(mObjects, newSize*sizeof(binder_size_t));
         if (objects == NULL) return NO_MEMORY;
         mObjects = objects;