Code: native_handle* Parcel::readNativeHandle() const
{
 int numFds, numInts;
 status_t err;
    err = readInt32(&numFds);
 if (err != NO_ERROR) return 0;
    err = readInt32(&numInts);
 if (err != NO_ERROR) return 0;

    native_handle* h = native_handle_create(numFds, numInts);
 if (!h) {
 return 0;
 }

 
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
        if (h->data[i] < 0) err = BAD_VALUE;
     }
     err = read(h->data + numFds, sizeof(int)*numInts);
     if (err != NO_ERROR) {
        native_handle_close(h);
        native_handle_delete(h);
        h = 0;
 }
 return h;
}

Vulnerability Type: Bypass 
CWE ID: CWE-20
Summary: libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a crafted application, aka internal bug 28395952.
Commit Message: Correctly handle dup() failure in Parcel::readNativeHandle

bail out if dup() fails, instead of creating an invalid native_handle_t

Bug: 28395952

Change-Id: Ia1a6198c0f45165b9c6a55a803e5f64d8afa0572
