Code: native_handle* Parcel::readNativeHandle() const
{
 int numFds, numInts;
 status_t err;
    err = readInt32(&numFds);
 if (err != NO_ERROR) return 0;
    err = readInt32(&numInts);
 if (err != NO_ERROR) return 0;

    native_handle* h = native_handle_create(numFds, numInts);
 if (!h) {
 return 0;
 }

 
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
        if (h->data[i] < 0) err = BAD_VALUE;
     }
     err = read(h->data + numFds, sizeof(int)*numInts);
     if (err != NO_ERROR) {
        native_handle_close(h);
        native_handle_delete(h);
        h = 0;
 }
 return h;
}

Commit Message: Correctly handle dup() failure in Parcel::readNativeHandle

bail out if dup() fails, instead of creating an invalid native_handle_t

Bug: 28395952

Change-Id: Ia1a6198c0f45165b9c6a55a803e5f64d8afa0572

CWE ID: CWE-20
native_handle* Parcel::readNativeHandle() const
{
 int numFds, numInts;
 status_t err;
    err = readInt32(&numFds);
 if (err != NO_ERROR) return 0;
    err = readInt32(&numInts);
 if (err != NO_ERROR) return 0;

    native_handle* h = native_handle_create(numFds, numInts);
 if (!h) {
 return 0;
 }

 
     for (int i=0 ; err==NO_ERROR && i<numFds ; i++) {
         h->data[i] = dup(readFileDescriptor());
        if (h->data[i] < 0) {
            for (int j = 0; j < i; j++) {
                close(h->data[j]);
            }
            native_handle_delete(h);
            return 0;
        }
     }
     err = read(h->data + numFds, sizeof(int)*numInts);
     if (err != NO_ERROR) {
        native_handle_close(h);
        native_handle_delete(h);
        h = 0;
 }
 return h;
}
