commit 3fe6770cc4195061e3ff999f47e5c289240b802f
author Bryan Ferris <bferris@google.com> Tue Jun 04 19:00:32 2019 -0700
committer Nikoli Cartagena <dargeren@google.com> Mon Jun 10 11:35:16 2019 -0700
tree c15b40620779c5a89db32f1dae14911eac74e389
parent 0491ab293f6fa7a5d28dff0e62ca283e4c3dfaad

[RESTRICT AUTOMERGE] libbinder: Status: check dataPosition sets.

Bug: 132650049
Test: fuzzer
Change-Id: Id230eae4316a444bc82b416b2049d5a5f589f89a
(cherry picked from commit f5edb02e9e96de8ff29bc4369d6dd6681ec0d7cf)

libs/binder/Status.cpp

diff --git a/libs/binder/Status.cpp b/libs/binder/Status.cpp
index d3520d6..3527546 100644
--- a/libs/binder/Status.cpp
+++ b/libs/binder/Status.cpp
@@ -66,13 +66,22 @@
     // Skip over fat response headers.  Not used (or propagated) in native code.
     if (mException == EX_HAS_REPLY_HEADER) {
         // Note that the header size includes the 4 byte size field.
-        const int32_t header_start = parcel.dataPosition();
+        const size_t header_start = parcel.dataPosition();
+        const size_t header_avail = parcel.dataAvail();
+
         int32_t header_size;
         status = parcel.readInt32(&header_size);
         if (status != OK) {
             setFromStatusT(status);
             return status;
         }
+
+        if (header_size < 0 || static_cast<size_t>(header_size) > header_avail) {
+          android_errorWriteLog(0x534e4554, "132650049");
+          setFromStatusT(UNKNOWN_ERROR);
+          return UNKNOWN_ERROR;
+        }
+
         parcel.setDataPosition(header_start + header_size);
         // And fat response headers are currently only used when there are no
         // exceptions, so act like there was no error.
@@ -95,6 +104,7 @@
     if (mException == EX_SERVICE_SPECIFIC) {
         status = parcel.readInt32(&mErrorCode);
     }
+
     if (status != OK) {
         setFromStatusT(status);
         return status;