commit fb4585b3dc8e5015dc91469ae004337601172aa9
author Devin Moore <devinmoore@google.com> Fri Feb 17 17:12:46 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Tue Mar 28 18:43:41 2023 +0000
tree af1cf60d2681391d72fae5ea76db391f470fdfb3
parent 5a2cb3d164568db9394b05db690a35b709661837

Check for malformed Sensor Flattenable

Test: libsensorserviceaidl_fuzzer with testcase from bug
Bug: 269014004
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:aeec1802f7befc8fbb18313ad3ac0969c3811870)
Merged-In: I0e255c64243c38876fb657cbf942fc1613363216
Change-Id: I0e255c64243c38876fb657cbf942fc1613363216

libs/sensor/Sensor.cpp

diff --git a/libs/sensor/Sensor.cpp b/libs/sensor/Sensor.cpp
index ec0ced8..b865c4d 100644
--- a/libs/sensor/Sensor.cpp
+++ b/libs/sensor/Sensor.cpp
@@ -632,7 +632,13 @@
         return false;
     }
     outputString8.setTo(static_cast<char const*>(buffer), len);
+
+    if (size < FlattenableUtils::align<4>(len)) {
+        ALOGE("Malformed Sensor String8 field. Should be in a 4-byte aligned buffer but is not.");
+        return false;
+    }
     FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len));
+
     return true;
 }