commit 6a99431c775b748ef15c205d8fd0dfb44a6e0389
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Mar 10 02:09:57 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Mar 10 02:09:57 2022 +0000
tree 50418c247ca2ddb3a7eb6948572efbc7d12136e6
parent 4242f3b196def25e1d757073dd0e377037ff1d8d
parent bfbbb04c096deccf43ad1c52e80c399a7be985ed

Snap for 8283941 from bfbbb04c096deccf43ad1c52e80c399a7be985ed to tm-release

Change-Id: I15ec03e6d79e6828f41a1b1dd93cafb152744c97

Parcel.cpp

diff --git a/Parcel.cpp b/Parcel.cpp
index 98300d0..a20d98c 100644
--- a/Parcel.cpp
+++ b/Parcel.cpp
@@ -1333,11 +1333,17 @@
             return false;
         }
         if (buffer_obj->parent_offset != parentOffset) {
-              ALOGE("Buffer parent offset %" PRIu64 " does not match expected offset %zu.",
+            ALOGE("Buffer parent offset %" PRIu64 " does not match expected offset %zu.",
                   static_cast<uint64_t>(buffer_obj->parent_offset), parentOffset);
             return false;
         }
 
+        // checked by kernel driver, but needed for fuzzer
+        if (parent >= mObjectsSize) {
+            ALOGE("Parent index %zu but only have %zu objects", parent, mObjectsSize);
+            return false;
+        }
+
         binder_buffer_object *parentBuffer =
             reinterpret_cast<binder_buffer_object*>(mData + mObjects[parent]);
         void* bufferInParent = *reinterpret_cast<void**>(