Fix null-deref crash while fuzzing

When random parcel is sent to incidentd, AIDL service
crashes with null pointer dereference.

Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
Bug: 282963041
Change-Id: I0e0ebc479acbfd3f5e9f56b629380b5d90021f45
This commit is contained in:
Pawan Wagh
2023-05-16 19:52:05 +00:00
parent 4d3ac1d568
commit 5482646109

View File

@@ -513,6 +513,9 @@ status_t IncidentService::onTransact(uint32_t code, const Parcel& data, Parcel*
sp<IShellCallback> shellCallback = IShellCallback::asInterface(data.readStrongBinder());
sp<IResultReceiver> resultReceiver =
IResultReceiver::asInterface(data.readStrongBinder());
if (resultReceiver == nullptr) {
return BAD_VALUE;
}
FILE* fin = fdopen(in, "r");
FILE* fout = fdopen(out, "w");