commit f28b295df90da3b9610cc5d6100039e54d95f49a
author Dan Austin <danielaustin@google.com> Thu Sep 10 13:46:02 2015 -0700
committer Alex Deymo <deymo@google.com> Tue Nov 17 17:49:15 2015 -0800
tree 43cd37d1dc03e898ecdd73408ea3c831fc09e969
parent 2ab8014d78fe89b022cd8f69024112780fecdd30

Benign unsigned integer overflow in Parcel

The realloc case in continueWrite did not update the
gParcelGlobalAllocCount value when an allocation occurred.

In addition, there are conditions that could cause the
gParcelGlobalAllocCount value to be decremented below 0, resulting
in a benign unsigned integer overflow that can cause corrupted values
to be returned through system profiling mechanisms.

BUG: 23972600

(cherry picked from commit 48fd7b457bb0657253d6012e787f50498b32ae42)

Change-Id: I1ad2ac02ab370402481550f6ab8f21fce42455e4

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 22d7ef3..df7a712 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -1671,8 +1671,14 @@
         if (mData) {
             LOG_ALLOC("Parcel %p: freeing with %zu capacity", this, mDataCapacity);
             pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
-            gParcelGlobalAllocSize -= mDataCapacity;
-            gParcelGlobalAllocCount--;
+            if (mDataCapacity <= gParcelGlobalAllocSize) {
+              gParcelGlobalAllocSize = gParcelGlobalAllocSize - mDataCapacity;
+            } else {
+              gParcelGlobalAllocSize = 0;
+            }
+            if (gParcelGlobalAllocCount > 0) {
+              gParcelGlobalAllocCount--;
+            }
             pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
             free(mData);
         }
@@ -1851,6 +1857,7 @@
                 pthread_mutex_lock(&gParcelGlobalAllocSizeLock);
                 gParcelGlobalAllocSize += desired;
                 gParcelGlobalAllocSize -= mDataCapacity;
+                gParcelGlobalAllocCount++;
                 pthread_mutex_unlock(&gParcelGlobalAllocSizeLock);
                 mData = data;
                 mDataCapacity = desired;