| commit | 65a8f07e57a492289798ca709a311650b5bd5af1 | [log] [tgz] |
|---|---|---|
| author | Casey Dahlin <sadmac@google.com> | Wed Oct 26 17:18:25 2016 -0700 |
| committer | Casey Dahlin <sadmac@google.com> | Wed Oct 26 17:18:25 2016 -0700 |
| tree | d6d7cbaa1f769f8f1cb5d0158c8ae5498a00a607 | |
| parent | 8211047138ea7892c73f4e6f6291a85a11759e0c [diff] |
Fix integer overflow in unsafeReadTypedVector
Passing a size to std::vector that is too big causes it to silently
under-allocate when exceptions are disabled, leaving us open to an OOB
write. We check the bounds and the resulting size now to verify
allocation succeeds.
Test: Verified reproducer attached to bug no longer crashes Camera
service.
Bug: 31677614
Change-Id: I064b1442838032d93658f8bf63b7aa6d021c99b7