From 5482646109517eebf45e5ca82f12e87faf18858c Mon Sep 17 00:00:00 2001
From: Pawan Wagh <waghpawan@google.com>
Date: Tue, 16 May 2023 19:52:05 +0000
Subject: [PATCH] Fix null-deref crash while fuzzing

When random parcel is sent to incidentd, AIDL service
crashes with null pointer dereference.

Test: atest incidentd_test
Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer
Bug: 282963041
Change-Id: I0e0ebc479acbfd3f5e9f56b629380b5d90021f45
---
 cmds/incidentd/src/IncidentService.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cmds/incidentd/src/IncidentService.cpp b/cmds/incidentd/src/IncidentService.cpp
index 5af02f405ed9c..c2f010097fdad 100644
--- a/cmds/incidentd/src/IncidentService.cpp
+++ b/cmds/incidentd/src/IncidentService.cpp
@@ -513,6 +513,9 @@ status_t IncidentService::onTransact(uint32_t code, const Parcel& data, Parcel*
             sp<IShellCallback> shellCallback = IShellCallback::asInterface(data.readStrongBinder());
             sp<IResultReceiver> resultReceiver =
                     IResultReceiver::asInterface(data.readStrongBinder());
+            if (resultReceiver == nullptr) {
+                return BAD_VALUE;
+            }
 
             FILE* fin = fdopen(in, "r");
             FILE* fout = fdopen(out, "w");