Skip to content

Commit d92ca44

Browse files
committed
binder: Give clear error when message is larger than parcel
Yes, it is lacking a test, but it seems we don't yet have good testing tools to help for tests like this. b/507253841
1 parent d862835 commit d92ca44

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

binder/src/main/java/io/grpc/binder/internal/Inbound.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,13 @@ private void handleMessageData(int flags, int index, Parcel parcel) throws Statu
399399
numBytes = parcel.dataPosition() - startPos;
400400
} else {
401401
numBytes = parcel.readInt();
402+
if (numBytes > parcel.dataAvail()) {
403+
throw Status.INTERNAL
404+
.withDescription(
405+
"Message size is larger than remaining parcel size: "
406+
+ numBytes + " > " + parcel.dataAvail())
407+
.asException();
408+
}
402409
block = BlockPool.acquireBlock(numBytes);
403410
if (numBytes > 0) {
404411
parcel.readByteArray(block);

0 commit comments

Comments
 (0)