| commit | abe42c95f650e8bf9dbb034263a8fcee9c0aaf46 | [log] [tgz] |
|---|---|---|
| author | Steven Moreland <smoreland@google.com> | Wed Dec 09 00:08:09 2020 +0000 |
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | Wed Dec 09 00:08:09 2020 +0000 |
| tree | 4717ace370be83e337c26e372cf798aeeac2b252 | |
| parent | 49db501563baddadaf1ed93c86abd65f242d5411 [diff] | |
| parent | 58f5cfa56d5282e69a7580dc4bb97603c409f003 [diff] |
libbinder: check null bytes in readString*Inplace am: 58f5cfa56d Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/native/+/13144867 MUST ONLY BE SUBMITTED BY AUTOMERGER Change-Id: I38ad7b4e9721041dd2dd8f791030bfc0d40b8670
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 9642a87..1f7d27e 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp
@@ -1869,7 +1869,7 @@ if (size >= 0 && size < INT32_MAX) { *outLen = size; const char* str = (const char*)readInplace(size+1); - if (str != nullptr) { + if (str != nullptr && str[size] == '\0') { return str; } } @@ -1929,7 +1929,7 @@ if (size >= 0 && size < INT32_MAX) { *outLen = size; const char16_t* str = (const char16_t*)readInplace((size+1)*sizeof(char16_t)); - if (str != nullptr) { + if (str != nullptr && str[size] == u'\0') { return str; } }