binder: check for overflow when alloc for security context
authorTodd Kjos <tkjos@android.com>
Wed, 24 Apr 2019 19:31:18 +0000 (12:31 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Apr 2019 19:26:49 +0000 (21:26 +0200)
commit0b0509508beff65c1d50541861bc0d4973487dc5
tree6237e6db6fc0f1355c60e9c9f6c924178219db59
parentd2f4a83fe3f7fcc2a8a10a39e367c5d1c6670327
binder: check for overflow when alloc for security context

When allocating space in the target buffer for the security context,
make sure the extra_buffers_size doesn't overflow. This can only
happen if the given size is invalid, but an overflow can turn it
into a valid size. Fail the transaction if an overflow is detected.

Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/android/binder.c