From 3c3e36876f5476a217b5a692c8d58bbdd3c60b59 Mon Sep 17 00:00:00 2001
From: Pawan Wagh <waghpawan@google.com>
Date: Thu, 18 May 2023 20:23:44 +0000
Subject: [PATCH] Use resizeOutVector in IncidentReportArg

IncidentReportArg doesn't handle cases when incorrect vector
length is provided in parcel. Using resizeOutVector Parcel API
instead.

Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
with clusterfuzz testcase
Bug: 283079842

Change-Id: I1682c8920c64faf5b0f2f6cd54b8517ec0f5d877
---
 libs/incident/src/IncidentReportArgs.cpp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/libs/incident/src/IncidentReportArgs.cpp b/libs/incident/src/IncidentReportArgs.cpp
index db495cfbf7e1b..d344a981ecea1 100644
--- a/libs/incident/src/IncidentReportArgs.cpp
+++ b/libs/incident/src/IncidentReportArgs.cpp
@@ -133,13 +133,12 @@ IncidentReportArgs::readFromParcel(const Parcel* in)
         mSections.insert(section);
     }
 
-    int32_t headerCount;
-    err = in->readInt32(&headerCount);
+    err = in->resizeOutVector<vector<uint8_t>>(&mHeaders);
     if (err != NO_ERROR) {
         return err;
     }
-    mHeaders.resize(headerCount);
-    for (int i=0; i<headerCount; i++) {
+
+    for (int i=0; i<mHeaders.size(); i++) {
         err = in->readByteVector(&mHeaders[i]);
         if (err != NO_ERROR) {
             return err;