Limit the number of keys read by KeyCharacterMaps.
Apps can send us a KCM containing a ridiculous key count, which will
cause us to crash when an allocation fails. Limit the key count so this
doesn't happen.
Bug: 24876135
Change-Id: I2bb4a5acabfc9184a867a406eef756c28c28f0ad
diff --git a/libs/input/KeyCharacterMap.cpp b/libs/input/KeyCharacterMap.cpp
index dd01a93..fe649fb 100644
--- a/libs/input/KeyCharacterMap.cpp
+++ b/libs/input/KeyCharacterMap.cpp
@@ -607,6 +607,10 @@
if (parcel->errorCheck()) {
return NULL;
}
+ if (numKeys > MAX_KEYS) {
+ ALOGE("Too many keys in KeyCharacterMap (%d > %d)", numKeys, MAX_KEYS);
+ return NULL;
+ }
for (size_t i = 0; i < numKeys; i++) {
int32_t keyCode = parcel->readInt32();