Check for malformed Sensor Flattenable

devinmoore-goog · devinmoore-goog · commit aeec1802f7be · 2023-02-22T23:14:17.000Z
Test: libsensorserviceaidl_fuzzer with testcase from bug
Bug: 269014004
Merged-In: I0e255c64243c38876fb657cbf942fc1613363216
Change-Id: I0e255c64243c38876fb657cbf942fc1613363216
diff --git a/libs/sensor/Sensor.cpp b/libs/sensor/Sensor.cpp
@@ -632,7 +632,13 @@ bool Sensor::unflattenString8(void const*& buffer, size_t& size, String8& output
         return false;
     }
     outputString8.setTo(static_cast<char const*>(buffer), len);
+
+    if (size < FlattenableUtils::align<4>(len)) {
+        ALOGE("Malformed Sensor String8 field. Should be in a 4-byte aligned buffer but is not.");
+        return false;
+    }
     FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len));
+
     return true;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -632,7 +632,13 @@ bool Sensor::unflattenString8(void const*& buffer, size_t& size, String8& output`
`632`	`632`	`return false;`
`633`	`633`	`}`
`634`	`634`	`outputString8.setTo(static_cast<char const*>(buffer), len);`
	`635`	`+`
	`636`	`+ if (size < FlattenableUtils::align<4>(len)) {`
	`637`	`+ ALOGE("Malformed Sensor String8 field. Should be in a 4-byte aligned buffer but is not.");`
	`638`	`+ return false;`
	`639`	`+ }`
`635`	`640`	`FlattenableUtils::advance(buffer, size, FlattenableUtils::align<4>(len));`
	`641`	`+`
`636`	`642`	`return true;`
`637`	`643`	`}`
`638`	`644`