Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use resizeOutVector in IncidentReportArg

Browse Source 
IncidentReportArg doesn't handle cases when incorrect vector
length is provided in parcel. Using resizeOutVector Parcel API
instead.

Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
with clusterfuzz testcase
Bug: 283079842

Change-Id: I1682c8920c64faf5b0f2f6cd54b8517ec0f5d877
This commit is contained in:
Pawan Wagh
2023-05-18 20:23:44 +00:00
parent 3c0960d65a
commit 3c3e36876f
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libs/incident/src/IncidentReportArgs.cpp
View File

@@ -133,13 +133,12 @@ IncidentReportArgs::readFromParcel(const Parcel* in)
mSections.insert(section);
}
int32_t headerCount;
err = in->readInt32(&headerCount);
err = in->resizeOutVector<vector<uint8_t>>(&mHeaders);
if (err != NO_ERROR) {
return err;
}
mHeaders.resize(headerCount);
for (int i=0; i<headerCount; i++) {
for (int i=0; i<mHeaders.size(); i++) {
err = in->readByteVector(&mHeaders[i]);
if (err != NO_ERROR) {
return err;