Code: sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const
{
 if (mHeap == 0) {
 Parcel data, reply;
        data.writeInterfaceToken(IMemory::getInterfaceDescriptor());
 if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) {
            sp<IBinder> heap = reply.readStrongBinder();
 ssize_t o = reply.readInt32();
 size_t s = reply.readInt32();

             if (heap != 0) {
                 mHeap = interface_cast<IMemoryHeap>(heap);
                 if (mHeap != 0) {
                    mOffset = o;
                    mSize = s;
                 }
             }
         }
     }
     if (offset) *offset = mOffset;
     if (size) *size = mSize;
    return mHeap;
 }

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.
Commit Message: Sanity check IMemory access versus underlying mmap

Bug 26877992

Change-Id: Ibbf4b1061e4675e4e96bc944a865b53eaf6984fe
