mapMemory: Do not map if size is > SIZE_MAX
Bug: 79376389
Test: hidl_test
Test: POC in bug
Change-Id: Ibaced858aa07bfd7ab6e938cc1339b974b0de14f
Merged-In: Ibaced858aa07bfd7ab6e938cc1339b974b0de14f
diff --git a/libhidlmemory/mapping.cpp b/libhidlmemory/mapping.cpp
index 3cb6485..8f0bcf4 100644
--- a/libhidlmemory/mapping.cpp
+++ b/libhidlmemory/mapping.cpp
@@ -24,6 +24,7 @@
#include <android-base/logging.h>
#include <android/hidl/memory/1.0/IMapper.h>
#include <hidl/HidlSupport.h>
+#include <log/log.h>
using android::sp;
using android::hidl::memory::V1_0::IMemory;
@@ -63,6 +64,15 @@
return nullptr;
}
+ // hidl_memory's size is stored in uint64_t, but mapMemory's mmap will map
+ // size in size_t. If size is over SIZE_MAX, mapMemory could succeed
+ // but the mapped memory's actual size will be smaller than the reported size.
+ if (memory.size() > SIZE_MAX) {
+ LOG(ERROR) << "Cannot map " << memory.size() << " bytes of memory because it is too large.";
+ android_errorWriteLog(0x534e4554, "79376389");
+ return nullptr;
+ }
+
Return<sp<IMemory>> ret = mapper->mapMemory(memory);
if (!ret.isOk()) {
