diff options
| author | Frederick Mayle <fmayle@google.com> | 2024-10-14 17:12:30 -0700 |
|---|---|---|
| committer | Julian Veit <Claymore1298@gmail.com> | 2025-01-13 08:20:15 +0100 |
| commit | ca0d154acb4adcc412b501f94b7232012345404e (patch) | |
| tree | 0f46fa927c4d07a81dcc08de12fd20412b4dc44e /opengl/tests/gl2_basic/gl2_basic.cpp | |
| parent | f2767b60aa4a88a45dd6baa0855b748deee215ae (diff) | |
binder: fix FD handling in continueWrite
Only close FDs within the truncated part of the parcel.
This change also fixes a bug where a parcel truncated into the middle of
an object would not properly free that object. That could have resulted
in an OOB access in `Parcel::truncateRpcObjects`, so more bounds
checking is added.
The new tests show how to reproduce the bug by appending to or partially
truncating Parcels owned by the kernel. Two cases are disabled because
of a bug in the Parcel fdsan code (b/370824489).
Cherry-pick notes: Add truncateFileDescriptors method instead of
modifying closeFileDescriptors to avoid API change errors. Tweaked the
test to support older C++ and android-base libs.
Flag: EXEMPT bugfix
Ignore-AOSP-First: security fix
Bug: 239222407, 359179312
Test: atest binderLibTest
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e77c9487166599cce197597038011f0879770ab4)
Merged-In: Iadf7e2e98e3eb97c56ec2fed2b49d1e6492af9a3
Change-Id: Iadf7e2e98e3eb97c56ec2fed2b49d1e6492af9a3
Diffstat (limited to 'opengl/tests/gl2_basic/gl2_basic.cpp')
0 files changed, 0 insertions, 0 deletions